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I.  PREDICTING  TERRORIST  ACTION 

A.  PROBLEM  STATEMENT 

While  it  may  be  difficult  to  disrupt  a  terrorist  network,  perhaps  we  can  improve 
our  ability  to  anticipate  where  and  when  the  next  attack  will  occur.  The  adaptation  of 
terrorists  in  order  to  avoid  detection  has  limited  the  number  of  characteristics  that  we  can 
search  for  or  track.  If  we  cannot  find  the  terrorists  directly,  we  must  focus  our  efforts  on 
another  strategy.  One  way  that  terrorist  networks  can  be  exploited  is  through  the 
determination  of  when  and  where  the  organization  will  make  its  next  attack.  If 
counterterrorism  forces  have  an  idea  of  when  and  where  the  terrorists  will  attack,  they 
can  plan  accordingly  in  terms  of  surveillance  and  security  presence,  which  could  lead  to 
the  prevention  of  said  attack  and/or  the  apprehension  of  its  perpetrators  before,  during,  or 
immediately  following  the  commission  of  their  act.  While  tactics  and  methods  may  have 
changed,  the  locations  of  these  acts  of  terrorism  have  stayed  more  or  less  consistent  over 
time,  driven  by  available  targets  and  opportunities  as  have  the  individual  traits  of  the 
perpetrators.  These  anticipatable  variables  may  be  able  to  yield  information  concerning 
the  potential  whereabouts  of  both  the  terrorists  as  well  as  the  locations  of  their  next 
attacks.  How  best  might  we  combine  these  variables  together  in  order  to  yield  the 
possible  locations  of  terrorists  and/or  their  attacks?  Is  it  possible  that  these  commonalities 
mean  that  something  that  works  well  for  law  enforcement  could  be  applied  to  intelligence 
and  security  analysis? 

B.  PURPOSE  AND  OBJECTIVES 

The  purpose  of  this  thesis  is  to  determine  whether  it  is  feasible  to  apply  the 
method  of  geographic  profiling,  a  method  successfully  used  by  law  enforcement  for 
hunting  serial  criminals,  to  terrorists  and  terrorist  acts.  In  general,  geographic  profiling 
“is  based  on  crime  pattern,  routine  activity,  and  rational  choice  theories  from 
environmental  criminology,  a  field  of  study  interested  in  the  interactions  between 
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criminals  and  the  physical  environment  that  surrounds  them.”!  Due  to  the  complexity  of 
terrorist  networks,  the  author  will  begin  by  studying  the  feasibility  of  applying 
geographic  profiling  toward  anticipating  the  next  actions  of  a  terrorist  organization  and 
predicting  when  are  where  their  next  attack  could  occur.  If  successful,  future  efforts  may 
move  toward  the  illumination  of  terrorist  networks  and  finally,  the  search  for  individuals 
within  the  organization.  Also  explored  will  be  whether  existing  models  of  geographic 
profiling  can  be  improved  upon  by  including  variables  not  just  related  to  the  location  of 
the  event,  but  to  terrorists  as  well. 

C.  METHODOLOGY 

This  thesis  will  utilize  data  concerning  terrorist  attacks  and  input  these  data  into 
established  models  of  geographic  profiling  to  see  whether  they  can  accurately  predict 
where  the  next  attack  will  occur.  Today,  there  are  four  primary  models  of  geographic 
profiling  utilized  by  law  enforcement  officials:  CrimeStat,  Rigel  Analyst,  Dragnet,  and 
Predator.  For  this  thesis,  the  CrimeStat  Version  III  program  will  be  utilized,  due  to  its 
accessibility  and  because  additional  variables  can  easily  be  included  in  the  program. 
Along  with  using  CrimeStat  to  conduct  analysis  of  terrorist  incidents,  information  about 
the  Philippines,  such  as  population  data,  terrain,  roads,  and  built-up  places  will  be 
incorporated  to  aid  in  determining  whether  the  location  where  future  incidents  occurred 
made  sense  and  could  be  predicted.  This  thesis  will  utilize  data  received  from  the 
Common  Operation  Research  Environment  (CORE)  Eab  concerning  terrorist  attacks  that 
occurred  in  the  Philippines  and  input  their  location  data  into  the  preexisting  and 
combination  models  of  geographic  profiling.  Not  all  of  the  data  from  each  set  will  be 
entered  because  the  later  attacks  will  serve  as  the  testing  criteria  for  each  of  the  models. 

It  is  the  goal  of  this  thesis  to  determine  whether  geographic  profiling  software  and 
techniques  can  be  utilized  to  predict  future  terrorist  attacks.  By  leaving  out  some  of  the 
data  from  the  data  sets,  it  will  be  possible  to  compare  the  predictions  made  by  the  various 


^  D.  Kim  Rossmo,  Ian  Laverty  and  Brad  Moore,  “Geographic  Profiling  for  Serial  Crime 
Investigation,”  in  Geographic  Information  Systems  and  Crime  Analysis,  ed.  Fahui  Wang  (Hershey,  PA; 
Idea  Group,  2005),  104. 
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models  to  the  actual  outcomes  and  determine  the  differences  between  the  two  in  order  to 
see  which  of  the  models  made  the  closest  prediction  to  the  actual  event  (i.e.,  reflected  in 
the  smallest  degree  of  difference). 
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II.  THE  APPLICABILITY  OL  GEOGRAPHIC  PROEILING 

TO  TERRORIST  ACTION 


A.  WHAT  IS  GEOGRAPHIC  PROFILING? 

Craig  Bennell  and  Shevaun  Corey  describe  geographic  profiling  as  “using 
knowledge  about  the  relative  locations  of  an  offender’s  crime  sites  to  predict  the  highest 
probable  location  of  his  or  her  residence. This  field  is  relatively  young,  started  in  1987 
by  D.  Kim  Rossmo,  and  is  currently  utilized  by  law  enforcement  agencies  to  prioritize 
suspects  in  criminal  investigations  and  determine  the  areas  where  to  saturate  police 
patrols.  Geographic  profiling  operates  under  the  premise  that  the  locations  of  crimes  are 
not  completely  random  but,  in  fact,  have  a  “degree  of  underlying  spatial  structure”  to 
them  because  there  is  some  rationality  behind  the  selection  of  their  locations. ^  The 
primary  goal  of  geographic  profiling  is  the  establishment  of  an  anchor  point,  or  the  place 
where  an  offender  primarily  operates  from,  and  likely  the  single  most  important  place  in 
his  or  her  life.  Anchor  points  can  include  the  offender’s  home,  his  or  her  workplace,  a 
home  of  a  friend  of  the  offender,  or  even  a  bar  or  restaurant.  Data  can  be  collected  from 
previous  crimes  and  used  to  create  a  profile  of  the  criminal’s  geography.  Rossmo’s  model 
operates  under  the  following  beliefs:  that  an  offender  is  more  likely  to  choose  locations 
that  are  closer  to  his  or  her  anchor  point  rather  than  farther  away,  and  though  the  offender 
targets  areas  closer  to  his  or  her  anchor  point,  he  or  she  will  avoid  targeting  locations  too 
close  to  this  anchor  point  in  order  to  avoid  being  caught.^ 

From  his  or  her  focal  point,  an  offender  searches  outward  for  the  target;  this 
search  is  typically  modeled  by  some  sort  of  distance-decay  function.  This  distance-decay 


^  Craig  Bennell  and  Shevaun  Corey,  “Geographic  Profiling  of  Terrorist  Attacks,”  in  Criminal 
Profilins:  International  Theory,  Research,  and  Practice,  ed.  R.N.  Kocsis  (Totowa,  NJ:  Humana  Press, 
2007),  190. 

3  D.  Kim  Rossmo,  “Place,  Space,  and  Police  Investigations:  Hunting  Serial  Violent  Criminals,”  Crime 
Prevention  Studies  4  (1995):  222. 

^  University  of  Washington  Department  of  Mathematics  student  team.  Yet  Another  Mathematical 
Approach  to  Geographic  Profiling:  Control  #7502  (Seattle:  University  of  Washington,  2010),  6. 
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function  illustrates  an  inverse  relationship  between  the  number  of  incidents  and  the 
distance  from  an  offender’s  anchor  point.^ 

In  order  to  construct  a  geographic  profile,  the  coordinates  of  crime  scenes  are 
entered  into  a  software  analysis  program  that  contains  an  algorithm  known  as  the  CGT 
(criminal  geographic  targeting).  The  CGT  algorithm  is  based  on  the  three-dimensional 
aspect  of  the  hunt  process  a  criminal  goes  through  when  searching  for  a  target.  As 
described  in  Geographic  Profiling  for  Serial  Crime  Investigation,  the  algorithm  “divides 
the  hunt  area  (the  area  enclosing  all  of  the  crime  sites)  into  a  fine  grid,  and  then  calculates 
the  probability  that  each  individual  grid  point  is  the  offender’s  anchor  point.”^  It  yields  a 
probability  graph,  called  a  jeopardy  surface,  where  the  greater  the  height  depicted,  the 
greater  the  probability  the  given  location  is  the  offender’s  anchor  point;  this  can  then  be 
converted  into  a  two-dimensional  map  and  overlaid  on  a  map  of  the  area.^  Once 
generated,  this  geographic  profile  has  a  number  of  applications  in  the  world  of  law 
enforcement. 

Since  the  advent  of  geographic  profiling,  this  method  has  helped  aid  in  several 
investigations  for  law  enforcement  agencies  including  the  Federal  Bureau  of 
Investigation  (FBI),  the  Royal  Canadian  Mounted  Police  (RCMP),  Scotland  Yard,  as  well 
as  agencies  at  the  state  and  local  levels. ^  Even  though  a  geographic  profile  does  not  mark 
the  exact  location  of  the  person  who  most  likely  committed  the  series  of  crimes,  it  does 
help  narrow  the  search  area  and  also  provides  another  possible  metric  to  compare  a  list  of 
suspects  against.  An  example  of  the  success  Scotland  Yard  has  had  with  utilizing  a 
geographic  profile  was  its  1994  to  1998  search  for  the  Mardi  Gras  Bomber.  The  bomber 
was  responsible  for  36  bombings  in  the  London  area  and  when  a  geographic  profile  was 
requested,  it  produced  two  areas  where  it  was  highly  probable  that  the  bomber  resided  or 
operated  from.  When  the  people  responsible  were  arrested,  their  residence  was  located  in 


5  Rossmo,  “Place,  Space,  and  Police  Investigations,”  223. 

^  Rossmo,  Laverty  and  Moore,  “Geographic  Profding  for  Serial  Crime  Investigation,”  107. 
7  Ibid.,  108. 

^  D.  Kim  Rossmo,  Geographic  Profiling  (Boca  Raton,  FL:  CRC  Press,  2000),  212. 
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the  top  3.4%  of  the  suspeet’s  hunting  area.^  Geographic  profiling  has  also  helped  to 
illuminate  search  areas  not  previously  considered,  as  was  the  case  of  the  South  Side 
Rapist  in  Lafayette,  LA.  Following  14  rapes  that  occurred  over  a  period  of  11  years,  the 
generated  geographic  profile  highlighted  a  new  neighborhood  that  served  as  the 
foundation  for  a  hotline  receiving  tips.  One  tip  matched  this  profile  as  well  as  a 
psychological  profile,  and  surveillance  of  the  suspect  led  to  obtaining  his 
deoxyribonucleic  acid  (DNA)  and  comparing  this  DNA  to  samples  collected  at  the  crime 
scenes  resulted  in  a  match  and  his  arrest,  lo 

Geographic  profiling  also  has  applications  outside  the  search  for  and 
apprehension  of  individual  perpetrators;  it  can  also  be  utilized  more  generally  for  the 
improvement  of  police  patrols.  In  Memphis,  TN,  city  officials  have  seen  a  decrease  in 
crime  with  the  help  of  operation  Blue  CRUSH  (Crime  Reduction  Utilizing  Statistical 
History).  “Blue  CRUSH  is  a  data  mining  approach  to  the  analysis  of  location-  and  time- 
based  criminal  patterns  and  evolving  trends. With  its  help,  Memphis  has  experienced  a 
16%  decline  in  crime  between  2006  and  2008.  This  program  is  able  to  utilize  existing  as 
well  as  incoming  data  from  police  patrols  on  a  variety  of  information  such  as  the  location 
of  crimes,  the  type  of  crime,  day  and  time  of  crimes,  and  victim  characteristics,  which 
help  generate  a  tactical  crime  prediction.  12  Blue  CRUSH’S  timely  incorporation  of  data 
into  a  multilayered  map  allows  police  patrol  and  unmarked  cars  to  be  placed  throughout 
the  city  in  hopes  of  catching  crimes  during  their  commission  and  serving  as  a  deterrent. 
The  program  has  helped  Memphis  reduce  both  drug  and  gang  related  activity  as  well  as 
crime  in  general  in  the  city.  1 3 


^  Rossmo,  Geographic  Profiling,  215-216. 

Rossmo,  Geographic  Profiling,  226. 

Walter  C.  Perry  et  al.,  “Using  Predictions  to  Support  Police  Operations,”  in  Predictive  Policing:  The 
Role  of  Crime  Forecasting  in  Law  Enforcement  Operations  (Santa  Monica,  CA;  RAND,  2012),  67. 

12  Perry  et  al.,  “Using  Predictions  to  Support  Police  Operations,”  68. 

13  Ibid. 
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B.  WHY  SHOULD  THE  UNITED  STATES  EXPLORE  EXPANDED 

UTILIZATION  OF  GEOGRAPHIC  PROFILING? 

The  prevailing  methods  of  counterterrorism  currently  in  use  are  alone  not  enough 
to  handle  the  task  of  stopping  terrorists  and  their  attacks.  Terrorists  do  not  operate  out  in 
the  open;  they  actively  seek  to  maintain  secrecy  and  the  element  of  surprise  because  these 
allow  them  to  instill  fear  in  their  enemies  and  increase  their  likelihood  of  survival, 
While  current  methods  of  counterterrorism  claim  some  success,  these  terrorist 
organizations  still  exist.  These  methods  have  included  counter-messaging,  trying  to  turn 
the  support  of  the  local  population  away  from  the  terrorists,  targeting  senior  leaders,  and 
seeking  to  reduce  their  numbers. All  of  these  methods  have  relied  heavily  on 
intelligence,  but  intelligence  can  be  flawed,  and  in  turn,  negatively  impact  the  choices 
made  based  on  the  collected  information. 

Intelligence  information  comes  in  several  forms  and  from  several  sources  of 
collection.  Due  to  the  abundance  of  intelligence  collected  not  only  by  intelligence 
services  but  from  tips  and  unusual  or  suspicious  activity  reports,  combined  with  a  lack  of 
proper  resources  to  handle  the  volume  of  information,  an  overload  can  occur.  1 6  Even 
though  a  large  amount  of  intelligence  is  received,  not  every  essential  piece  of  intelligence 
needed  to  make  a  decision  can  be  collected.  The  information,  even  if  accurate,  will  not 
always  be  analyzed  and  disseminated  in  a  timely  manner.  Sometimes,  the  assets  needed 
to  collect  intelligence  are  not  always  available.  When  utilizing  people  to  collect 
information,  language  and  cultural  barriers  can  exist  that  prevent  these  outsiders  from 
being  able  to  either  infiltrate  an  organization  or  work  with  the  local  population.  Even  if 
able  to  obtain  information  from  people  on  the  inside  in  the  form  of  defectors  or 
informants,  that  intelligence  could  be  unreliable  and  further  set  back  counterterrorism 
efforts.  The  events  of  September  11  highlight  another  problem  with  intelligence:  even  if 


David  Charters,  “Counterterrorism  Intelligence:  Sources,  Methods,  Process,  and  Problems,”  in 
Democratic  Responses  to  International  Terrorism  (New  York:  Transnational  Pub,  1990),  228-229. 

Martha  Crenshaw,  “How  Terrorism  Declines,”  Terrorism  and  Political  Violence  3,  no.  1  (1991), 
85.. 

D.  Kim  Rossmo  and  Keith  Harries,  “The  Geospatial  Structure  of  Terrorist  Cells,”  Justice  Quarterly 
2S,  no.  2  (2011):  222. 
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the  information  is  collected,  if  it  is  not  shared  among  all  intelligence  agencies  and 
relevant  organizations,  opportunities  can  be  missed  and  countries  can  fall  victim  to  a 
terrorist  attack.!^  Because  of  these  issues,  perhaps  it  is  time  to  incorporate  new  methods 
into  the  fight,  methods  such  as  geographic  profiling.  The  information  overload  problem 
will  continue  to  exist  for  the  foreseeable  future,  but  geographic  profiling  would  allow  for 
this  abundant  information  to  be  utilized  in  a  different  manner.  Kim  Rossmo  and  Keith 
Harries  highlight  that  “because  of  the  prevalence  of  spatial  information,  however, 
geographic  prioritization  models  can  be  useful  tools  in  the  management  of  information 
overload  situations.”!^  In  How  Does  Studying  Terrorism  Compare  to  Studying  Crime, 
Gary  LaFree  and  Laura  Dugan  highlight  how  researchers  of  terrorism  could  incorporate 
geographic  profiling  techniques. 

An  important  strategy  used  by  criminologists  to  study  spatial  and  temporal 
patterns  of  events  employs  geographic  mapping  techniques.  Just  as  these 
scholars  have  imbedded  crime  incidents  into  maps  of  countries  and  cities, 
terrorism  researchers  can  create  regional  and  world-wide  maps  depicting 
numbers  and  rates  of  terrorist  activities  around  the  globe. 

Geographic  profiling  offers  a  possible  solution  to  the  problems  caused  by  a  reliance  on 
intelligence.  The  models  of  geographic  profiling  currently  in  use  utilize  for  their  inputs 
hard  data  points  such  as  location  and  distance  from  a  particular  point.  Geographic 
profiling  also  removes  the  uncertainty  about  the  correctness  of  the  information  because 
the  data  is  based  on  the  location  of  attacks  that  have  already  occurred  and  that 
information  is  able  to  be  verified.  It  also  is  able  to  move  past  cultural  and  language 
concerns  because  it  does  not  rely  on  human  agents  to  obtain  the  needed  information. 
Finally,  because  the  location  of  attacks  is  common  knowledge,  the  various  agencies 
would  not  have  to  struggle  to  gather  information  from  each  other,  which  help  to  reduce 
the  reliance  counterterrorism  agencies  have  on  one  another. 


Charters,  “Counterterrorism  Intelligenee,”  252-257. 

Rossmo  and  Harries,  “The  Geospatial  Strueture  of  Terrorist  Cells,”  222. 

Gary  LaFree  and  Laura  Dugan,  “How  Does  Studying  Terrorism  Compare  to  Studying  Crime?” 
Terrorism  and  Counter-Terrorism:  Criminological  Perspectives  5  (2004):  68. 
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Apart  from  the  possibility  that  geographic  profiling  could  be  utilized  in  aiding  the 
prediction  of  where  and  when  a  terrorist  organization  will  attack  next,  geographic 
profiling  could  potentially  offer  other  applications  to  the  military  such  as  for 
incorporation  into  their  cordon  and  search  operations,  which  would  aid  in 
counterinsurgency  operations. 

C.  SIMILARITIES  BETWEEN  SERIAL  CRIMINALS  AND  TERRORISTS 

In  order  to  export  the  theory  of  geographic  profiling  to  counterterrorism,  a 
number  of  assumptions  about  terrorists  and  serial  criminals  need  to  be  examined.  At  first 
glance,  there  may  not  appear  to  be  many  similarities  between  the  two  groups,  but  upon 
closer  examination,  the  two  share  several  commonalities.  In  order  for  a  crime  to  occur, 
three  requirements  must  be  met:  a  motivated  offender,  a  suitable  target,  and  the  lack  of  an 
authority’s  presence, 20  something  both  serial  crimes  and  terrorist  attacks  share.  Both 
types  of  offenders,  serial  criminals  and  terrorists,  commit  multiple  offenses;  the  two  can 
both  have  a  signature,  which  makes  it  possible  to  determine  whether  or  not  it  is  the  same 
individual  or  group  committing  a  crime  or  attack.  Deborah  Schurman-Kauflin  argues  that 
another  similarity  shared  by  serial  criminals,  serial  killers  in  particular,  and  terrorists  lies 
in  the  fact  that  both  types  have  a  fantasy  of  some  sort  and  want  to  see  that  fantasy  come 
to  life;  they  will  then  seek  activities  that  reinforce  that  what  they  want  to  do  is  correct.^i 

Another  similarity  exists  between  the  two  types  during  the  preparation  phase 
because,  as  a  criminal  or  terrorist  prepares  for  an  attack,  they  generally  have  a  specific 
sequence  of  events  that  they  follow.  Michael  Freeman,  David  Tucker,  and  Steffen  Merten 
have  divided  the  actions  a  terrorist  or  terrorist  organization  conducts  prior  to  the  attack 
into  nine  distinct  phases:  “networking,  training,  general  planning,  attack-specific 
recruitment,  financing,  operational  planning,  weapons  procurement,  logistical 
preparation,  and  operational  preparation.  ”22  Further  modeling  into  these  nine  distinct 

2*^  Rossmo,  Laverty  and  Moore,  “Geographic  Profiling  for  Serial  Crime  Investigation,”  105. 

21  Deborah  Schurman-Kauflin,  Disturbed:  Terrorist  Behavioral  Profiles  (Sun  City,  AZ;  Violent 
Crimes  Institute,  LLC,  2008),  89. 

22  Michael  Freeman,  David  Tucker,  and  Steffen  Merten,  “Pathways  to  Terror:  Finding  Patterns  Prior 
to  an  Attack,”  Journal  of  Policing,  Intelligence  and  Counter  Terrorism  5,  no.  1  (2010):  76. 
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phases  by  Thompson  and  Fox  has  given  priority  values  to  these  phases  using  multi¬ 
attribute  decision  making  (MADM)  analysis.  Using  Analytical  Hierarchy  Process  as  the 
vehicle  for  MADM  their  results  showed  that  terrorist  training,  networking,  planning,  and 
operational  preparation  account  for  65.2%  of  the  priority  value,  see  Table  1. 


Phases 

Percentage 

Prioritization  or 
Ranking 

Terrorist  Training 

27.40% 

1 

Networking 

16.40% 

2 

Planning 

11.40% 

3 

Operational 

Preparation 

10.00% 

4 

Financing 

8.56% 

5 

Recruitment 

8.00% 

6 

Operational  Planning 

7.20% 

7 

Weapons  Procurement 

6.10% 

8 

Logistical  Preparation 

4.86% 

9 

Table  1.  The  Table  Shows  the  Final  Outcome  from  the  AHP  Analysis  by  Fox 

and  Thompson. 23 

Furthermore,  they  applied  the  technique  of  order  preference  by  similarity  to  ideal 
solution  (TOPSIS)  and  obtained  the  priorities  shown  in  Table  2,  where  operational 
preparation,  terrorist  training,  networking,  and  recruiting  account  for  76.46%  of  their 

priorities.  24 


23  William  P.  Fox  and  Nicholas  Thompson,  “Phase  Targeting  of  Terrorist  Attacks:  Simplifying 
Complexity  with  AHP  and  TOPSIS,”  Journal  of  Defense  Management  4,  no.  1 16  (2014). 

24  Fox,  “Phase  Targeting  of  Terrorist  Attacks.” 
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TOPSIS 

Phases 

Ranking 

Percent 

Cumulative 

Percent 

0.816936 

Operational 

Preparation 

I 

26.1996 

26.1996 

0.774866 

Recruiting 

2 

24.85038 

51.04998 

0.49741 

Terrorist  Training 

3 

15.95221 

67.00219 

0.294915 

Networking 

4 

9.458104 

76.46029 

0.268568 

Weapons  Procurement 

5 

8.6I3I36 

85.07343 

0.174234 

Planning 

6 

5.58778 

90.66121 

0.126706 

Financing 

7 

4.063533 

94.72474 

0.086217 

Operational  Planning 

8 

2.765018 

97.48976 

0.078273 

Logistical  Preparation 

9 

2.510244 

100 

3.II8I24 

Total 

Table  2.  This  Table  Shows  the  Cumulative  Percentages  Generated  through 

TOPSIS  Analysis  by  Fox  and  Thompson. ^5 

The  two  methods  share  terrorist  training,  networking,  and  operational  preparation 
among  their  top  three  variables.  These  give  us  insights  into  the  process.  This  information 
can  be  incorporated  by  security  forces  and  intelligence  analysts,  who  previously  have 
been  likely  to  determine  what  sort  of  attack  a  particular  organization  may  be  working 
toward,  and  be  able  to  focus  their  efforts  on  looking  for  a  particular  set  of  events  to  occur 
in  order  to  more  accurately  determine  the  timing  of  an  attack  and  perhaps  be  able  to 
prevent  it  from  happening. 

Finally,  when  narrowing  serial  criminals  down  to  serial  killers,  the  further 
comparison  of  target  type  can  be  included  to  illustrate  their  similarities  because  both 
groups  tend  to  choose  soft  targets.  While  several  terrorist  organizations  aim  to  eventually 
conduct  a  large-scale  attack  against  an  important  landmark  or  other  piece  of  infrastructure 
that  would  likely  produce  a  devastating  effect  on  an  entire  country,  their  day-to-day 
attacks  focus  more  on  smaller-scale  efforts  that  target  people.  Much  like  the  more 
commonplace  attacks  made  by  terrorists  the  “soft”  people  over  the  “hard”  pieces  of 
infrastructure;  serial  criminals  tend  to  target  those  in  society  who  are  more  vulnerable  to 
attack. 


Ibid. 
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D.  PREVIOUS  ATTEMPTS  TO  APPLY  GEOGRAPHIC  PROFILING  TO 

TERRORISM 

Previous  attempts  to  apply  geographic  profiling  to  terrorism  are  few  in  number, 
and  these  few  attempts  have  yielded  mixed  results.  Craig  Bennell  and  Shevaun  Corey 
examined  two  terrorist  groups,  Action  Directe,  which  primarily  operated  in  France  and 
The  Revolutionary  People’s  Struggle  in  Greece.  They  chose  to  focus  on  one  specific 
individual  in  each  group  and  a  series  of  attacks  that  they  were  tied  to.  The  two 
researchers  ran  their  collected  information  through  geographic  profiling  software  and  in 
the  case  of  Action  Directe,  were  not  able  to  accurately  identify  the  individual’s  anchor 
point  due  to  the  offender  traveling  great  distances  to  attack  his  targets.  However,  in  the 
case  of  The  Revolutionary  People 's  Struggle,  the  geographic  profile  was  able  to  identify 
the  location  of  the  individual’s  anchor  point  with  a  14%  hit  percentage  because  the 
offender  did  not  travel  great  distances. 26  Their  research  posited  that  geographic  profiling 
has  five  assumptions  that  have  to  be  met  in  order  to  ensure  accuracy:  “the  profile  must  be 
based  on  multiple  crime  sites,  the  crimes  must  be  linked  to  the  same  offender,  the 
offender  committing  the  crimes  cannot  be  commuting  into  the  area  of  criminal  activity, 
the  distribution  of  suitable  targets  must  be  relatively  uniform  around  the  offender’s  home, 
and  the  offender  cannot  move  anchor  points  during  his  or  her  crime  series. ”22  However, 
terrorist  attacks  and  their  perpetrators  do  not  always  meet  these  five  assumptions.  They 
explain  that  two  assumptions  of  the  five  assumptions  will  frequently  be  met  and  the 
remaining  three  will  only  sometimes  be  met.  In  the  cases  studied  by  Bennell  and  Covey 
the  assumptions  that  will  frequently  be  met  in  the  terrorist  context  are  the  first  two;  they 
require  multiple  crimes  and  locations  as  well  as  all  the  offenses  need  to  be  tied  to  the 
same  individual.  The  other  three  assumptions  will  only  sometimes  be  met,  but  it  is 
believed  that  under  certain  conditions,  these  assumptions  could  be  met.28  They  conclude 
their  research  stating  that  “geographic  profiling  may  be  possible  in  the  terrorist  context. 


26  Bennell  and  Corey,  “Geographic  Profiling  of  Terrorist  Attacks,”  195-199. 

27  Ibid,  192-193. 

28  Ibid.,  192-195. 
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but  only  under  certain  conditions. ”^9  However,  they  claim  that  they  may  have 
underestimated  the  value  of  geographic  profiling  and  that  it  needs  to  be  further  explored. 

Another  effort  that  sought  to  apply  geospatial  information  concerning  terrorist 
cells  and  their  eventual  attacks  in  order  to  determine  whether  any  spatial  patterns  exist  in 
their  behavior  was  headed  by  D.  Kim  Rossmo  and  Keith  Harries.  They  studied  the 
behavior  of  terrorist  cells  operating  in  Ankara  and  Istanbul,  Turkey. The  primary  goal 
of  their  research  “was  to  develop  the  basis  for  a  geographic  prioritization  model  that 
could  be  used  to  help  locate  various  elements  of  terrorist  cells,  similar  to  the  one  used  in 
the  geographic  profiling  of  serial  crime. ”3i  In  their  course  of  their  research,  they 
discovered  that  local  and  proximate  spatial  relationships  exist  between  terrorist  incidents 
and  the  location  of  their  cells. ^2  Their  model  was  also  able  to  demonstrate  the  feasibility 
of  making  a  geospatial  approach  to  studying  terrorist  actions.  They  also  concluded  that 
like  criminals,  in  terms  of  geography,  terrorists  behave  rationally.  Furthermore,  they  state 
that  their  model  could  be  improved  upon  by  the  inclusion  of  three  factors:  “base  rate  or 
prior  probability  of  an  active  terrorist  cell  in  a  given  area;”  “incorporating  a  demographic 
analysis;”  and  incorporating  more  than  one  cell  site. 33  Together,  these  previous  efforts  to 
apply  geographic  profiling  or  geospatial  analysis  to  some  aspect  of  terrorism  indicate  that 
this  new  approach  is  possible,  but  will  require  further  research  and  work;  something  this 
thesis  seeks  to  accomplish. 


29  Ibid.,  199. 

30  Rossmo  and  Harries,  “The  Geospatial  Strueture  of  Terrorist  Cells,”  222. 

31  Ibid.,  243. 

32  Ibid.,  242. 

33  Ibid.,  243-244. 
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III.  GEOGRAPHIC  PROFILING  SOFTWARE  AND  CASE  STUDY 


A.  GEOGRAPHIC  INFORMATION  SYSTEMS 

According  to  Susan  Smith  and  Christopher  Bruce,  geographic  information 
systems  (GIS)  are  “hardware  and  software  that  collects,  stores,  retrieves,  manipulates, 
queries,  analyzes,  and  displays  spatial  data.  GIS  is  a  computerized  fusion  of  maps  with 
underlying  databases  that  provide  information  about  map  objects. ”34  GIS  generates  a  map 
and  this  map  can  be  analyzed  visually;  however,  this  visual  interpretation  can  only  get 
someone  so  far  and  further,  more  complete  analysis  is  needed,  especially  when  large 
amounts  of  data  points  are  being  analyzed.  In  order  to  complete  these  more  complex 
calculations,  spatial  statistics,  or  “mathematical  technique  that  apply  descriptive  and 
multivariate  statistics,  mathematical  modeling,  and  algorithms  to  spatial  data,”  are  needed 
and  that  is  where  CrimeStat  can  be  utilized.35 

B.  CRIMESTAT 

CrimeStat  was  first  released  in  August  1999,  but  the  edition  that  was  utilized  in 
this  thesis  is  version  3.3  (CrimeStat  III).  CrimeStat  IV  (version  4.0)  was  released  this  past 
November  but  not  evaluated  in  this  thesis,  as  instructional  material  for  this  new  version 
was  not  available  until  spring  2014.  “CrimeStat  is  a  Windows-based  spatial  statistics 
application  developed  by  Ned  Levine  and  Associates  of  Houston,  Texas,  under  a  grant 
from  the  NIJ”  (National  Institute  of  Justice). 36  CrimeStat  is  not  a  GIS,  but  it  can  read  files 
from  those  programs  and  also  produce  results  that  can  be  read  by  a  GIS.  It  takes  the 
locations  where  crimes  occurred  and  is  able  to  perform  a  wide  array  of  calculations  on 
these  coordinates. 37  All  of  these  can  be  exported  as  various  map  layers  that  can  be 
displayed  in  a  GIS. 


34  S.  Smith  and  C.  Bruce,  CrimeStat  III  User  Workbook  (Washington,  DC;  National  Institute  of 
Justice,  2008),  2. 

35  Ibid.,  3. 

36  Ibid.,  4. 

37  Ibid. 
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CrimeStat  is  designed  to  help  users:  identify  patterns  in  erime;  identify  a  “target 
area”  in  whieh  a  serial  offender  is  most  like  to  strike  next;  identify  and  prioritize  hot 
spots;  conduct  a  risk  analysis  throughout  the  area  of  operations  based  on  where  previous 
incidents  have  occurred;  and  to  produce  a  geographic  profile. 38  Most  of  these  specified 
goals  coincide  with  the  goals  of  this  thesis,  making  CrimeStat  an  attractive  analysis  tool 
for  use. 

CrimeStat  is  self-described  as  being  easy  to  use  and  its  instruction  manual  covers 
its  operation  in  just  four  steps:  enter  the  data  in  the  “data  setup”  screen;  choose  what 
analysis  wanted  along  with  the  parameters;  run  the  computation;  close  output  window. 
An  additional  step  is  required  if  the  resultant  output  is  a  map  layer  and  therefore  must  be 
opened  in  a  CIS  program.  39  In  order  to  run,  one  primary  file  consisting  of  X  and  Y 
coordinates  is  required;  but  another  attractive  element  of  CrimeStat  is  that  it  allows  for  a 
secondary  file  to  be  included  that  the  primary  file  can  be  compared  to  in  the  running  of 
certain  spatial  statistics.  An  example  of  this  is  placing  the  location  of  homicides  in  the 
primary  file  and  poverty  rates  for  the  same  area  in  the  secondary  file.  Of  course 
CrimeStat  is  not  the  only  type  of  software  available  with  application  for  geographic 
profiling.  As  previously  mentioned,  three  other  major  programs  exists:  Rigel,  Dragnet, 
and  Predator,  but  “CrimeStat’ s  virtue  is  collecting  different  methods  of  spatial  statistical 
analysis  into  a  single  application  that  works  with  multiple  geographic  information 
systems,”  and  is  fairly  simple  to  use  even  though  the  analysis  it  performs  can  be  rather 
complex.  40 

C.  THE  DATA 

In  this  thesis,  the  incidents  of  terrorism  that  will  be  analyzed  came  from  a 
Stanford  University  dissertation  by  Joseph  H.  Felter,  titled  “Taking  Guns  to  a  Knife 
Fight:  A  Case  for  Empirical  Study  of  Counterinsurgency”  by  way  of  the  Naval 
Postgraduate  School’s  Common  Operational  Research  Environment  (CORE)  Lab.  The 

38  Smith  and  Bruce,  CrimeStat  III  User  Workbook,  5. 

39  Ibid.,  8. 

40  Ibid.,  7. 
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data  covered  the  time  period  of  2001  to  2008  in  the  Philippine  major  island  of  Mindanao 
and  its  surrounding  smaller  islands.  Mindanao  is  the  southernmost  island  in  the 
Philippines  and  is  the  second  largest  in  size.  Since  the  Philippines  achieved  independence 
in  1946,  this  island  in  particular  has  experienced  a  large  amount  of  terrorist  activity  from 
a  number  of  different  organizations  focused  on  achieving  either  independence  or 
autonomy  from  the  government.  The  data  provided  includes  the  date  of  the  incident, 
where  it  occurred,  who  it  involved,  what  sort  of  incident  it  was,  the  number  of  casualties, 
and  other  categories  of  information.^!  The  total  number  of  incidents  over  this  eight-year 
period  was  10,990,  but  that  number  includes  incidents  initiated  by  counterinsurgency  and 
local  police  forces.  The  removal  of  these  incidents  reduces  the  number  of  incidents  to 
4,601  enemy-initiated  events.  As  there  are  several  different  terrorist  groups  and  other 
organizations  responsible  for  all  of  these  incidents,  the  data  will  be  further  broken  down 
into  the  four  primary  organizations:  Communist  Terrorist  Movements  (CTM),  Lawless 
Elements  (LE),  Moro  Islamic  Eiberation  Eront  (MIEE),  and  the  Abu  Sayyaf  Group 
(ASG).  The  terrorist  organization  that  this  thesis  will  focus  on  is  the  Abu  Sayyaf  Group, 
as  their  incidents  are  more  concentrated,  rather  than  being  dispersed  throughout 
Mindanao,  like  the  other  organizations. 

Another  program  utilized  in  this  thesis  was  ArcMap  10.1,  a  component  of  the 
ArcGIS  program,  developed  by  Esri.  Both  CrimeStat  and  ArcMap  were  used  to  develop 
an  image  highlighting  the  locations  of  terrorist  incidents  by  the  ASG,  perform  a  number 
of  calculations,  and  visualize  the  calculations  as  layers  of  data  points  in  ArcMap. 

In  CrimeStat,  the  data  set  was  uploaded  as  an  ArcGIS  shapefile;  the  geographic 
area  of  reference  the  data  falls  in  was  set;  the  measurement  parameters  selected;  and  the 
type  of  calculation  wanted  chosen.  The  types  of  calculations  utilized  in  CrimeStat 
included:  spatial  description,  such  as,  mean  center  and  standard  distance,  standard 
deviation  ellipse,  median  center,  center  of  minimum  distance,  nearest  neighbor  analysis, 
and  hot  spot  analysis;  and  spatial  modeling,  to  include  kernel  density  estimate. 


^!  Joseph  Fetter,  “Taking  Guns  to  a  Knife  Fight:  A  Case  for  Empirieal  Study  of  Counterinsurgeney” 
(PhD  diss.,  Stanford  University,  2009). 
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D.  THE  ABU  SAYYAF  GROUP 


The  Abu  Sayyaf  group  is  commonly  believed  to  have  formed  sometime  during  the 
late  1980s  or  early  1990s  following  repeated  perceived  failures  by  the  Moro  National 
Liberation  Front  (MNLF),  the  first  group  that  emerged  against  the  Philippine  state  in 
order  to  achieve  secession  from  the  country  and  establish  an  Islamic  state.  The  efforts  of 
the  MNLF  and  later  the  MILF,  the  first  organization  to  break  away  from  the  MNLF  and 
form,  had  resulted  in  the  establishment  of  the  Autonomous  Region  in  Muslim  Mindanao 
(ARMM).  The  ARMM  was  originally  intended  to  be  created  in  1976  as  a  result  of  the 
Tripoli  Agreement  between  the  government  and  the  MNLF,  but  a  breakdown  in  how  to 
implement  the  agreement  prevented  the  formation  of  the  ARMM  until  1989.42  Currently, 
five  provinces  compose  the  ARMM:  Basilan,  except  for  Isabela  City;  Sulu;  Lanao  del 
Sur;  Maguindanao;  and  Tawi-Tawi.  The  establishment  of  the  ARMM  “provided  a  limited 
measure  of  self-rule.  But  the  autonomous  government  lacked  the  resources  to  tackle  the 
problems  of  the  poorest  region  of  the  Philippines,  and  the  devastation  caused  by  years  of 
war.  ”43  Throughout  its  existence,  the  ASG  has  operated  primarily  throughout  the 
ARMM,  but  the  majority  of  its  attacks  have  occurred  in  the  provinces  of  Basilan  and 
Sulu,  both  areas  that  have  served  as  a  base  of  operations  for  the  ASG. 

ASG  is  a  small  organization;  today  it  is  believed  to  not  have  any  more  than  500 
members,  though  no  one  is  certain  about  just  how  many  people  have  joined.  Compared  to 
the  MNLF  and  the  MILF,  it  is  certainly  the  most  violent;  of  the  three,  it  is  the  only  group 
that  has  been  designated  by  the  United  States  and  has  been  included  on  the  US  State 
Department’s  list  of  Foreign  Terrorist  Organizations  (FTO).  Like  the  other  two  separatist 
groups,  the  ASG  is  committed  to  the  creation  of  an  independent  Muslim  state;  however, 
the  ASG  is  anti-Christian,  and  many  of  its  attacks  target  this  population.  The  founder  of 
the  ASG,  Ustadz  Abdurajak  Janjalani,  believed  that  the  only  way  to  achieve  this  just 
Islamic  state  is  through  the  use  of  jihad  and  encouraged  Muslims  to  go  all  the  way  to  the 


42  Sylvia  Concepcion  et  al.,  “Breaking  the  Links  between  Economics  and  Conflict  in  Mindanao,” 
presented  at  the  Waging  Peace  conference  in  Manila,  December  2003,  9,  http://ki- 
volunteer.org/index.php?option=com_docman&task=doc_download&gid=2&Itemid=79. 

43  Ibid.,  11. 
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highest  level,  martyrdom,  to  help  achieve  it."^"*  Since  its  creation,  the  ASG  has  changed  its 
method  of  attack,  switching  back  and  forth  between  bombings  and  kidnap  for  ransoms 
(KFR),  depending  on  the  current  situation. 

From  2001  to  2008,  of  the  4,601  enemy-initiated  incidents  in  Mindanao,  299  were 
perpetrated  by  the  Abu  Sayyaf  group.  For  the  299  incidents  analyzed  the  breakdown  of 
the  type  of  incidents  and  how  many  of  each  type  are  depicted  in  Table  3. 


Incident  Type 

Total  Number 
Initiated 

Percentage  of  Total 
Incidents 

Abduction 

27 

9.030 

Ambush 

44 

14.716 

Armed  Clash 

2 

0.669 

Arson 

3 

1.003 

Bombing 

13 

4.348 

Disarming 

I 

0.334 

Encounter 

32 

10.702 

Harassment 

47 

15.719 

Hold-Up 

I 

0.334 

Hostage  Taking 

2 

0.669 

Jail  Break 

2 

0.669 

Kidnapping 

II 

3.679 

Killing 

3 

1.003 

Land  Mining 

8 

2.676 

Liquidation 

13 

4.348 

Mutilation 

I 

0.334 

Raid 

10 

3.344 

Sabotage 

I 

0.334 

Sea  Jacking 

I 

0.334 

Shooting 

26 

8.696 

Stabbing 

2 

0.669 

Strafing 

3 

1.003 

Surrender 

(Capture) 

46 

15.385 

Total 

299 

100 

Table  3.  ASG-Initiated  incidents  in  Mindanao:  2001-2008 


Rommel  C.  Banlaoi,  “The  Abu  Sayyaf  Group:  From  Mere  Banditry  to  Genuine  Terrorism,” 
Southeast  Asian  Ajfairs  2006,  25 1 . 
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With  so  many  different  types  of  incidents  being  utilized  by  the  ASG,  it  raises 
whether  this  organization  attacked  with  what  was  convenient.  With  this  in  mind,  the 
different  incidents  have  also  been  analyzed  in  groups  similar  in  type.  These  groupings 
and  the  new  percentages  are  shown  in  Table  4. 


Incident  Type 

Total  Number 
Initiated 

Percentage  of 
Total  Incidents 

Abduction/Hostage  Taking/ 
Kidnapping/Sea  Jacking 

41 

13.71237458 

Ambush/ Armed  Clash/ Arson/ 
Bombing/  Killing/Liquidation/ 
Mutilation/Shooting/ 
Stabbing/Strafing 

110 

36.78929766 

Encounter/Haras  sment 

79 

26.42140468 

Hold-Up/Sabotage 

2 

0.668896321 

Disarming/Surrender  (Capture) 

47 

15.71906355 

Jail  Break 

2 

0.668896321 

Land  Mining 

8 

2.675585284 

Raid 

10 

3.344481605 

Table  4.  ASG-Initiated  incidents  in  Mindanao:  2001-2008  (Grouped) 


However,  not  all  299  incidents  were  analyzed  in  this  thesis;  the  41  incidents  that 
occurred  on  the  island  of  Mindanao  lie  outside  the  geographical  scope  of  this  study.  This 
thesis  focuses  on  the  258  incidents  that  occurred  on  the  islands  of  Basilan  (78)  and  Sulu 
(180).  These  incidents  will  be  analyzed  both  on  a  year-to-year  basis  as  well  as  part  of  a 
larger  group  (2001-2007)  in  terms  of  both  incident  number  and  type;  these  results  will 
then  be  compared  to  the  actual  data  from  2008  in  order  to  determine  whether  or  not 
different  methods  of  analysis  aid  in  predicting  where  incidents  will  occur  and  what  type 
of  incidents  will  occur.  The  various  strategies  for  analyzing  the  ASG-initiated  incident 
data  will  focus  on  hot  spot  analysis,  percent  differences  based  on  average  outcomes 
compared  to  the  actual  outcomes,  and  normalization  by  both  total  number  of  incidents 
and  population  of  each  municipality. 
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IV.  ANALYZING  THE  ABU  SAYYAF  GROUP’S  ACTIVITIES 


A.  RESULTS  AND  ANALYSIS 

In  order  to  determine  whether  geographic  profiling  techniques  were  able  to  effectively 
indicate  the  location  of  future  attacks,  the  incidents  that  occurred  in  2008  were  removed 
from  calculations  performed  both  by  CrimeStat  and  ArcGIS  software  programs.  The  data 
the  analysis  was  performed  on  covered  the  years  2001  to  2007;  the  results  of  this  analysis 
were  compared  to  incidents  that  occurred  in  2008  in  the  same  geographic  areas  (Basilan 
and  Sulu).  Apart  from  comparing  the  2008  events  to  those  that  happened  from  2001- 
2007,  other  comparisons  will  be  made:  year  to  year  in  both  number  of  total  incidents  and 
type  of  incident;  and  municipality  comparisons  in  both  number  and  type  of  incidents.  In 
order  to  measure  the  success  of  particular  geographic  profiling  techniques,  primarily  this 
thesis  will  focus  on  the  associated  percentages  generated  from  each  portion  of  analysis. 
These  percentages  will  either  be  based  on  either  the  accuracy  of  a  particular  method  in 
forecasting  where  an  incident  will  occur  (what  type  of  incident  it  will  be)  or  the  percent 
difference  between  the  calculated  average  from  the  2001-2007  period  and  the  actual 
outcome  from  2008. 

The  largest  portion  of  this  analysis  was  conducted  utilizing  different  types  of  hot 
spot  analysis,  a  tool  used  in  identifying  where  crime  incidents  cluster.  Hot  spots  are 
defined  as  “concentrations  of  incidents  within  a  limited  geographic  area  that  appear  over 
time. Several  different  types  of  hot  spot  analysis  methods  exist,  but  for  the  purpose  of 
this  thesis  point  location  analysis  was  utilized  due  to  the  sheer  size  of  the  area  being 
studied.  This  type  of  clustering  technique  involves  counting  how  many  incidents  occurred 
at  each  location;  the  locations  with  the  highest  number  of  incidents  are  identified  as  hot 

spots. 


45  Ned  Levine  &  Associates,  CrimeStat  IV:  A  Spatial  Statistics  Program  for  the  Analysis  of  Crime 
Incident  Locations  Manual  (Washington,  DC:  National  Institute  of  Justice,  2013),  7.1. 

46  Ibid.,  7.2. 
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In  CrimeStat,  this  type  of  hot  spot  analysis  is  called  the  Mode  routine.  With  this 
analysis,  the  locations  that  saw  the  highest  number  of  incidents  will  be  indicated;  the  top 
locations  from  the  years  2001-2007  will  be  compared  to  the  incidents  that  occurred  in 
2008  to  determine  whether  or  not  the  incidents  follow  a  pattern  by  continuing  to  occur  in 
locations  that  were  previously  the  site  of  an  incident.  Running  this  analysis  means  that 
the  incidents  will  be  counted,  the  frequency  of  the  events  calculated,  and  the  resulting 
ranking  of  most  to  least  frequent  locations  are  generated  in  the  output.  Along  with  a 
ranking  of  locations,  CrimeStat  also  creates  a  ‘dbf  file  that  can  be  imported  into  ArcGIS 
and  depicted  for  visual  interpretation. 

B.  MICROSOFT  EXCEL— ANALYZING  HISTORICAL  DATA  FOR 

INCIDENT  NUMBER  AND  TYPE 

For  the  eight  years  of  incident  data,  the  information  was  broken  out  into  the  number  of 
incidents  that  occurred  in  total  for  both  Sulu  and  Basilan  and  then  further  broken  down 
by  how  many  incidents  occurred  in  each  municipality  each  year  from  2001  to  2008.  The 
resulting  break  down  is  depicted  in  Tables  5  and  6. 
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Number  of  Incidents  in  Sulu  Municipalities  /  Percentage  of  Year's  Total  Incidents 


Year 

2001 

2002 

2003 

2004 

2005 

2006 

2007 

2008 

Total  Incidents 
Occurred 

44 

10 

19 

10 

27 

31 

17 

22 

Municipality 

Indanan 

3 

6.82 

4 

40.00 

2 

10.53 

0 

0.00 

11 

40.74 

6 

19.35 

4 

23.53 

1 

4.55 

Jolo 

5 

11.36 

0 

0.00 

3 

15.79 

1 

10.00 

0 

0.00 

14 

45.16 

0 

0.00 

0 

0.00 

Kalingalan 

Caluang 

2 

4.55 

1 

10.00 

0 

0.00 

0 

0.00 

0 

0.00 

0 

0.00 

1 

5.88 

0 

0.00 

Luuk 

0 

0.00 

0 

0.00 

0 

0.00 

0 

0.00 

0 

0.00 

0 

0.00 

0 

0.00 

1 

4.55 

Maimbung 

5 

11.36 

0 

0.00 

2 

10.53 

4 

40.00 

4 

14.81 

4 

12.90 

1 

5.88 

4 

18.18 

Old  Panamao 

2 

4.55 

0 

0.00 

2 

10.53 

0 

0.00 

3 

11.11 

0 

0.00 

0 

0.00 

0 

0.00 

Panglima 

Estino 

1 

2.27 

0 

0.00 

0 

0.00 

0 

0.00 

0 

0.00 

0 

0.00 

1 

5.88 

1 

4.55 

Parang 

0 

0.00 

1 

10.00 

0 

0.00 

1 

10.00 

4 

14.81 

0 

0.00 

4 

23.53 

1 

4.55 

Patikul 

7 

15.91 

4 

40.00 

7 

36.84 

4 

40.00 

3 

11.11 

5 

16.13 

2 

11.76 

13 

59.09 

Talipao 

19 

43.18 

0 

0.00 

3 

15.79 

0 

0.00 

2 

7.41 

2 

6.45 

4 

23.53 

1 

4.55 

Table  5.  Sulu  Incidents  Broken  Down  by  Year  and  Municipality 
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As  indicated  (bolded)  in  Table  5,  there  are  three  municipalities  that  either  saw  at 
least  one  incident  either  every  year  (Patikul),  or  in  seven  out  of  the  eight  years  (88%) 
(Indanan  and  Maimbung).  One  other  municipality,  Talipao,  sees  an  incident  in  six  out  of 
the  eight  years  (75%).  Together,  these  four  municipalities  outweighed  the  other  six 
municipalities  in  Sulu;  all  of  the  municipalities  that  experienced  attacks  in  five  of  the 
seven  preceding  years  to  2008,  would  go  on  to  experience  an  incident  in  2008.  Out  of  the 
eight  years  covered,  only  in  2006,  did  a  municipality  not  in  the  previously  mentioned 
four,  Jolo,  the  island’s  capital,  have  the  highest  number/percentage  of  incidents.  Half  of 
the  time,  Patikul  was  either  the  municipality  that  saw  the  most  activity  or  was  tied  for  the 
most  activity,  one  of  those  years  being  2008.  In  attempting  to  make  a  prediction  about 
which  municipality  would  be  likely  to  see  an  incident  occur  in  2008,  the  following 
observation  can  be  made:  if  a  municipality  experiences  an  incident  in  four  out  of  the 
seven  years  preceding  2008,  the  municipality  has  an  83%  (5/6)  chance  of  having  an 
incident  occur  during  2008.  It  also  can  be  observed  that  if  a  municipality  experiences  an 
incident  in  three  or  less  of  the  years  preceding  2008,  that  municipality  has  a  50%  (2/4) 
chance  of  experiencing  an  incident;  though  it  also  appears  that  if  a  majority  of  events  take 
place  in  the  earlier  years  (2001-2004),  the  municipality  is  less  likely  to  be  the  location  of 
a  2008  incident. 
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Number  of  Incidents  in  Basilan  Municipalities  /  Percentage  of  Year's  Total  Incidents 

Year 

2001 

2002 

2003 

2004 

2005 

2006 

2007 

2008 

Total  Incidents 
Occurred 

27 

9 

8 

6 

4 

0 

9 

15 

Municipality 

Isabela 

2 

7.41 

3 

33.33 

2 

25.00 

2 

33.33 

0 

0.00 

0 

0.00 

1 

11.11 

0 

0.00 

Lamitan 

10 

37.04 

0 

0.00 

0 

0.00 

I 

16.67 

0 

0.00 

0 

0.00 

I 

11. II 

I 

6.67 

Lantawan 

4 

14.81 

2 

22.22 

3 

37.50 

0 

0.00 

0 

0.00 

0 

0.00 

I 

11. II 

0 

0.00 

Maluso 

I 

3.70 

0 

0.00 

0 

0.00 

I 

16.67 

0 

0.00 

0 

0.00 

0 

0.00 

0 

0.00 

Sumisip 

5 

18.52 

4 

44.44 

1 

12.50 

2 

33.33 

3 

75.00 

0 

0.00 

0 

0.00 

1 

6.67 

Tipo-Tipo 

2 

7.41 

0 

0.00 

0 

0.00 

0 

0.00 

0 

0.00 

0 

0.00 

6 

66.67 

4 

26.67 

Tuburan 

3 

II. II 

0 

0.00 

2 

25.00 

0 

0.00 

I 

25.00 

0 

0.00 

0 

0.00 

9 

60.00 

Table  6.  Basilan  Incidents  Broken  Down  by  Year  and  Municipality 
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As  highlighted  in  Table  6,  unlike  the  municipalities  of  Sulu,  those  of  Basilan  were 
not  the  sites  of  an  incident  every  year  or  almost  every  year;  instead,  only  two 
municipalities  (bolded),  Sumisip  and  Isabela  (the  capital),  experienced  an  incident  six 
(75%)  or  five  (63%)  years  out  of  the  eight,  though  it  should  be  noted  that  although 
Isabela  experienced  an  incident  in  five  of  the  years  leading  up  to  2008,  it  did  not 
experience  an  incident  in  2008.  Unlike  Sulu,  where  a  municipality  experiencing  incidents 
in  four  or  more  of  the  seven  years  leading  up  to  2008  greatly  increased  a  region’s  chance 
of  having  an  incident  in  2008,  Basilan’s  municipalities  tend  to  experience  a  2008  incident 
if  they  experienced  incidents  in  fewer  years.  For  those  municipalities  that  experienced 
incidents  in  three  or  less  years  preceding  2008,  there  is  a  75%  (3/4)  chance  of  an  incident 
occurring  in  2008;  whereas  for  the  municipalities  experiencing  incidents  in  four  or  more 
of  the  seven  previous  years,  there  is  only  a  33%  (1/3)  chance  of  the  municipality  serving 
as  the  location  of  a  2008  incident.  For  these  municipalities  (Isabela  and  Lantawan),  four 
out  of  three  or  three  out  of  their  four  years  in  which  an  incident  occurred  fell  during  the 
2001-2004  time  period.  Of  note,  during  the  year  2006,  Basilan  experienced  zero  ASG- 
initiated  incidents. 

To  illustrate  how  Sulu  and  Basilan  compared  to  one  another  overall,  the  total 
number  of  incidents  of  each  were  compared.  As  the  total  number  of  incidents  that 
occurred  in  Sulu  over  the  eight  years  outnumbered  the  incidents  that  occurred  in  Basilan, 
the  percentage  difference  between  the  two  islands  was  also  calculated.  The  results  are 
shown  in  Table  7. 
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Total  Incidents  in 
Sulu 

44 

10 

19 

Total  Incidents  in 
Basilan 

27 

9 

8 

Total  Incidents 

71 

19 

27 

Percentage  of 
Events  in  Sulu 

61.97 

52.63 

70.37 

Percentage  of 
Events  in  Basilan 

38.03 

47.37 

29.63 

Percentage  Sulu 
Events 
Outnumber 
Basilan  Events 

23.94 

5.26 

40.74 

Table  7.  Sulu  Incident 


10 

27 

31 

17 

22 

6 

4 

0 

9 

15 

16 

31 

31 

26 

37 

62.50 

87.10 

100.00 

65.38 

59.46 

37.50 

12.90 

0.00 

34.62 

40.54 

25.00 

74.19 

100.00 

30.77 

18.92 

versus  Basilan  Incident  Totals 


When  the  total  number  of  incidents  occurring  on  each  island  is  compared,  as  expected  the 
total  number  of  incidents  on  Basilan  was  less  than  half  of  the  total  incidents  that  occurred 
on  Sulu.  In  all  seven  years  leading  up  to  2008  Sulu  experiences  more  incidents  than 
Basilan,  meaning  the  higher  occurrence  of  incidents  in  2008  in  Sulu  once  again  make 
sense.  Overall,  while  Sulu  incidents  might  outnumber  the  Basilan  incidents  two-to-one, 
this  ratio  is  not  maintained  throughout  the  years.  Out  of  the  eight  years,  only  in  two 
(25%)  of  them  does  Sulu  have  more  than  twice  the  number  of  incidents  as  Sulu;  however, 
in  these  two  years,  the  difference  is  quite  large  (74.19%  and  100%). 

To  further  identify  any  patterns  that  emerged,  the  incidents  were  broken  down 
once  again  by  year,  but  this  time,  further  subdivided  by  the  total  number  of  each  type  of 
incidents  that  occurred  each  year  on  the  island.  The  result  of  this  division  is  found  in 
Table  8. 
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Several  observations  can  be  made  from  viewing  Table  8.  First,  the  only  type  of 
incident  that  occurs  every  year  in  both  municipalities,  with  the  exception  of  Basilan  on 
2006  where  zero  incidents  occurred),  was  ambush.  Sulu  also  experienced  harassment 
every  year  from  2001  to  2008,  though  in  Basilan,  this  type  of  incident  occurred  in  only 
three  of  the  eight  years.  During  the  2001-2008,  in  four  out  of  the  eight  years  (50%),  Sulu 
and  Basilan  share  the  most  common  type  of  incident.  In  2001  surrender  was  most 
common  (21  and  nine);  in  2003  encounter  is  the  incident  that  occurred  the  most  (nine  and 
two);  in  2002,  it  was  encounter  (four)  for  Sulu  and  surrender  (four)  for  Basilan;  in  2005, 
the  most  common  incident  was  ambush  (nine  and  two),  though  Sulu  also  experienced 
nine  incidents  of  harassment;  and  in  2008,  both  Sulu  and  Basilan  experienced  ten 
abductions.  In  2006,  since  Basilan  experienced  zero  incidents  that  year,  the  highest 
numbers  of  incidents  in  Sulu  were  ambush  and  liquidation  (seven).  As  for  the  other  three 
years,  while  the  type  of  incident  occurred  most  frequently  differed,  the  highest  number  of 
incidents  was  the  same  for  both  Sulu  and  Basilan.  In  2002,  Sulu  experienced  four 
encounters  and  Basilan  four  surrenders;  in  2004,  Sulu  experienced  two  ambushes, 
harassments,  and  surrenders  while  Basilan  experienced  two  shootings;  lastly,  in  2007, 
Sulu  saw  six  ambushes  and  Basilan  six  incidents  of  harassment. 

Beyond  looking  at  which  events  occur  most  frequently  and  how  many  of  each 
type  of  incident  occurs,  further  observations  can  be  made  about  when  the  different 
incident  types  occur.  For  both  encounters  and  surrenders  these  types  of  incidents  stop 
happening  after  2004;  these  could  go  hand  in  hand  with  one  another  as  surrender  is 
interpreted  as  an  ASG-initiated  encounter  that  results  in  the  ASG  surrendering.  Like 
encounters  and  surrenders,  kidnapping  stops  occurring  after  2004,  but  a  similar  incident 
type,  abduction,  takes  its  place  from  2004  and  onward  to  2008,  meaning  that  between  the 
two,  an  incident  occurs  every  year  on  Sulu  and  occasionally  on  Basilan.  Lastly,  there  is 
one  event  that  occurs  in  five  out  of  eight  years  (63%)  in  both  Sulu  and  Basilan,  though  in 
different  years:  shooting;  however,  the  instances  of  shooting  are  sporadic  throughout  the 
eight  years  (2001,  2003,  2005,  2007-2008  for  Sulu  and  2001,  2003-2004,  2007-2008  for 
Basilan). 


30 


Finally,  the  types  of  incidents  that  occurred  in  2008  were:  abduction,  ambush, 
arson,  bombing  (though  not  on  Sulu),  harassment,  liquidation  (though  not  on  Basilan), 
and  shooting.  For  Sulu,  if  the  island  experienced  a  particular  kind  of  incident  in  three  or 
more  out  of  the  seven  years  prior  to  2008,  there  is  a  63%  (5/8)  chance  that  the  island 
would  also  experience  the  same  type  of  incident  in  2008.  For  the  three  types  of  incidents 
that  occurred  in  three  or  more  years  but  did  not  occur  in  2008  (encounter,  kidnap,  and 
surrender/capture),  all  occasions  of  these  incidents  occurred  during  the  2001-2004  time 
frame.  Out  of  the  six  types  of  incidents  that  occurred  on  Sulu  during  2008,  83%  (5/6) 
occurred  in  three  or  more  previous  years.  As  for  Basilan,  if  a  type  of  incident  was 
experienced  in  three  or  more  years  prior  to  2008;  the  chances  are  similar  to  those  on  Sulu 
at  66%  (2/3).  Like  Sulu,  the  one  incident  type  that  occurred  in  more  than  three  years  yet 
did  not  occur  in  2008(encounter),  never  happened  after  2003.  The  same  is  true  if  you 
lower  the  number  of  year’s  threshold  to  two,  though  the  likelihood  of  a  similar  type  of 
incident  occurring  reduces  to  50%  (3/6).  Out  of  the  six  types  of  incidents  that  occurred  on 
Basilan  in  2008,  only  33%  (2/6)  occurred  in  three  or  more  years;  the  same  can  be  said  for 
the  incident  types  happening  in  only  one  out  of  seven  years. 

To  further  illustrate  the  breakdown  into  individual  incident  type,  the 
corresponding  percentages  of  each  type  of  event  occurring  on  Sulu  and  Basilan  by  year 
are  shown  in  Table  9. 
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As  previously  mentioned,  since  there  was  such  diversity  in  incident  type,  perhaps 
the  ASG  simply  utilized  the  most  convenient  method  available  at  the  time.  With  this  in 
mind,  the  different  incident  types  that  were  similar  in  nature  were  combined  and  analyzed 
in  the  same  manner  as  each  type  separately.  The  number  of  each  grouping  of  incidents 
and  their  percentages  are  displayed  in  Tables  10  and  11. 
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Number  of  Incident  Type  on  Each  Island 

Year 

2001 

2002 

2003 

2004 

2005 

2006 

2007 

2008 

Island 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Incident  Type 

Abduction/Hostage  Taking/ 
Kidnapping/Sea  Jacking 

2 

1 

1 

1 

1 

1 

2 

1 

0 

1 

0 

2 

0 

10 

10 

Ambush/ Armed  Clash/ 
Arson/B  ombing/Killing/ 
Liquidation/  Mutilation/ 
Shooting/Stabbing/Strafing 

9 

3 

3 

1 

6 

4 

4 

3 

3 

21 

0 

2 

5 

4 

Encounter/Harassment 

6 

5 

3 

2 

3 

0 

9 

0 

D 

0 

3 

6 

7 

1 

Hold-Up/Sabotage 

0 

0 

0 

0 

0 

0 

0 

0 

1 

1 

0 

0 

0 

0 

0 

0 

Disarming/Surrender 

(Capture) 

21 

9 

1 

4 

2 

0 

2 

0 

1 

0 

0 

0 

0 

0 

0 

0 

Jailbreak 

0 

0 

0 

0 

0 

0 

0 

1 

0 

0 

0 

0 

0 

1 

0 

0 

Land  Mining 

0 

0 

0 

0 

0 

1 

0 

0 

2 

0 

5 

0 

0 

0 

0 

0 

Raid 

6 

3 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

Table  10.  Incidents  by  Type  per  Year  (Groupings) 
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Percentage  of  Incident  Type  on  Each  Island 

Year 

2001 

2002 

2003 

2004 

2005 

2006 

2007 

2008 

Island 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Sulu 

Basilan 

Incident  Type 

Abduction/Hostage 

Taking/ 

Kidnapping/Sea  Jacking 

4.55 

3.70 

10.00 

11.11 

5.26 

12.50 

10.00 

33.33 

3.70 

0.00 

3.23 

0.00 

11.76 

0.00 

45.45 

66.67 

Ambush/ Armed  Clash/ 
Arson/B  ombing/ 
Killing/Liquidation/ 
Mutilation/Shooting/ 
Stabbing/Strafing 

20.45 

11.11 

30.00 

11.11 

31.58 

50.00 

40.00 

50.00 

48.15 

75.00 

67.74 

0.00 

70.59 

22.22 

22.73 

26.67 

Encounter/Harassment 

13.64 

40.74 

50.00 

33.33 

52.63 

25.00 

30.00 

0.00 

33.33 

0.00 

12.90 

0.00 

17.65 

66.67 

31.82 

6.67 

Hold-Up/Sabotage 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

3.70 

25.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

Disarming/Surrender 

(Capture) 

47.73 

33.33 

10.00 

44.44 

10.53 

0.00 

20.00 

0.00 

3.70 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

Jailbreak 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

16.67 

0.00 

0.00 

0.00 

0.00 

0.00 

11.11 

0.00 

0.00 

Land  Mining 

0.00 

0.00 

0.00 

0.00 

0.00 

12.50 

0.00 

0.00 

7.41 

0.00 

16.13 

0.00 

0.00 

0.00 

0.00 

0.00 

Raid 

13.64 

11.11 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

Table  1 1 .  Percentages  of  Incidents  by  Year  Per  Type  (Groupings) 
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Grouping  the  incidents  together  by  similar  type  highlights  that  the  grouping  of 
ambush,  armed  clash,  etc.  for  both  Sulu  and  Basilan  is  the  most  prevalent  grouping  of 
incidents  in  four  out  of  eight  years  (50%)  and  three  out  of  seven  years  (43%), 
respectively.  These  tables  highlight  that  certain  incident  types  simply  are  not  as  numerous 
compared  to  others;  however,  in  these  cases,  the  incidents  that  have  low  percentages  are 
also  those  that  either  stand  alone  or  are  partnered  with  only  one  other  incident.  As 
discovered  in  tables  8  and  9,  the  surrender  grouping,  after  a  few  years  of  prevalence, 
quickly  diminishes;  the  opposite  can  be  said  for  the  ambush,  armed  clash,  etc.  grouping. 
From  2001  to  2007,  this  group’s  percentage  steadily  climbs  each  year;  although  in  2008 
its  percentage  is  not  as  high  as  in  previous  years,  it  does  make  sense  as  these  incident 
types  occurred  in  all  preceding  years.  The  other  groupings  that  occur  in  2008  also  follow 
this  pattern  as  each  of  these  groupings  experienced  a  number  of  incidents  in  a  majority  of 
years.  From  looking  at  these  tables,  security  forces  would  be  able  to  see  which  incident 
types  occur  most  frequently  and  therefore,  be  able  to  predict  which  practices  and 
operations  to  focus  on. 

C.  HOT  SPOT  ANALYSIS 

Of  the  299  incidents  that  were  initiated  by  the  ASG,  180  took  place  on  the  island  of  Sulu, 
158  during  the  years  2001  to  2007  and  22  occurring  in  2008.  CrimeStat’s  Hot  Spot  Mode 
routine  was  run  on  the  2001  to  2007  incidents  and  generated  locations  where  incidents 
occurred.  The  top  locations  are  identified  in  Table  12. 
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Rank 

Municipality 

(Location  in  Decimal  Degrees) 

Number  of  Incidents 

1 

Jolo  (6.044251, 

121.01007) 

12 

2 

Indanan  (5.99428, 

120.960286) 

9 

Patikul  (6.043645, 

121.089826) 

9 

3 

Talipao  (5.962007, 

121.09313) 

6 

Patikul  (6.047924, 

121.142882) 

6 

4 

Indanan  (5.949059, 

120.952817) 

5 

5 

Talipao  (5.979516, 

121.075123) 

4 

Parang  (5.970464, 

120.910145) 

4 

Jolo  (6.053346, 

121.006827) 

4 

Maimbung  (5.950357, 

121.009857) 

4 

Table  12.  Top  Ten  Most  Frequent  Locations  of  ASG  Incidents 


The  resulting  output  from  CrimeStat  was  imported  into  ArcGIS  and  generated  the  image 
shown  in  Figure  1 . 
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(5)  -  Jolo  -  4 

(2)  -  Patikul  -  9 

(3)  -  Patikul  -  6 

\ 

\ 

-4--' - 

Legend 

4.0  Incidents 
5.0  Incidents 
6.0  Incidents 
9.0  Incidents 
12.0  Incidents 


Figure  1.  Top  Ten  Locations  for  Incidents  on  Sulu,  According  to  CrimeStat 
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Of  the  top  10  locations  for  2001-2007  incidents,  only  one  location  saw  at  least 
one  incident  happen  in  2008;  the  location  in  Patikul  (121.089826,  6.043645  decimal 
degrees)  that  was  the  scene  of  nine  incidents  from  2001  to  2007,  saw  two  incidents  occur 
in  2008.  The  overlay  of  2008  incidents  on  the  top  ten  hot  spots  for  Sulu  from  2001  to 
2007  is  shown  in  Figure  2. 
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Figure  2.  Sulu  2008  Incidents  Compared  to  2001-2007  CrimeStat  Hot  Spots 
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As  shown  in  Figure  2,  two  outlying  incidents  occurred  in  2008:  one,  in  Luuk 
involved  harassment  by  the  ASG;  and  the  other,  abduction,  occurred  in  Panglima  Estino. 
However,  these  two  incidents  appear  to  be  just  that,  outliers.  The  harassment  that  happens 
in  Luuk  is  the  only  incident  the  municipality  saw  over  the  eight-year  period  and  out  of  the 
incidents  in  the  neighboring  municipalities  (Old  Panamao  and  Kalingalan  Caluang),  Old 
Panamao  was  the  only  municipality  where  harassments  occurred,  but  these  incidents 
happened  three  years  previously.  The  abduction  that  took  place  in  Panglima  Estino  was 
only  the  third  incident  seen  in  the  municipality  (2001  and  2007  were  the  years  of  the 
other  incidents)  and  the  only  abduction.  However,  unlike  the  harassment  in  Luuk,  this 
abduction  was  the  only  abduction  that  occurred  within  the  neighboring  region.  Although 
the  incidents  were  rather  isolated  from  others,  in  2008,  the  incidents  that  did  occur  tended 
to  be  either  an  abduction  or  harassment  (ten  and  seven  out  of  twenty-two,  respectively). 

Of  the  119  remaining  ASG-initiated  incidents,  78  took  place  on  the  island  of 
Basilan,  63  from  2001  to  2007  and  15  during  2008.  CrimeStat’s  Mode  routine  was  run  on 
this  set  of  data  and  the  top  locations  are  identified  in  Table  13. 


Rank 

Municipality 

(Location  in  Decimal  Degrees) 

Number  of  Incidents 
Occurring  in  Same 
Location 

1 

Sumisip 

(6.467481,  121.993832) 

5 

2 

Tuburan 

(6.630038,  122.239598) 

4 

3 

Lamitan 

(6.648478,  122.104057) 

3 

Lamitan 

(6.642691,  122.155193) 

3 

Tipo-Tipo 

(6.460622,  122.153796) 

3 

Sumisip  (6.451078, 

121.978106) 

3 

Lantawan 

(6.646073,  121.891488) 

3 

Table  13.  Top  Seven  Most  Erequent  Locations  of  ASG  Incidents 

The  results  from  Basilan  were  input  into  ArcGIS  and  are  depicted  in  Eigure  3. 
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Figure  3.  Top  Seven  Locations  for  Incidents  on  Basilan,  According  to 

CrimeStat 


Just  like  the  2008  incidents  that  occurred  in  Sulu,  one  location,  the  location  in  the 
Basilan  municipality  of  Lamitan  (122.104057,  6.648478  Decimal  Degrees)  that  was  the 
site  of  3  incidents  during  the  2001  to  2007  years,  was  the  scene  of  an  incident  during 
2008.  The  overlay  of  2008  incidents  on  the  top  ten  hot  spots  for  Basilan  from  2001  to 
2007  is  shown  in  Figure  4. 
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For  both  of  these  islands,  running  CrimeStat’s  Hot  Spot  Analysis  routine  on 
2001-2007  incidents  and  overlaying  the  2008  incidents  on  the  resulting  output  reveals 
that  only  one  of  the  identified  top  hot  spots  is  the  location  of  an  incident  in  2008.  For 
Sulu  this  means  that  8%  (1/12)  of  2008  locations  are  the  same  location  as  a  top  hot  spot 
and  for  Basilan  14%  (1/7)  locations  are  the  same  location  for  a  top  hot  spot.  However,  for 
Sulu,  if  all  CrimeStat-generated  Hot  Spots  are  included,  this  increases  the  likelihood  a 
2008  incident  location  will  be  the  same  as  a  2001-2007  hot  spot  (25%  or  4/12). 

In  both  Sulu  and  Basilan,  most  of  the  incidents  occurred  nearby  other  incidents 
during  2008,  but  some  of  the  2008  incidents  appeared  to  be  more  isolated  than  others. 
Whereas  in  Sulu  where  the  two  outlying  incidents  really  were  quite  isolated,  the 
“isolated”  incidents  on  Basilan  (Sumisip  and  Tipo-Tipo)  were  located  near  other  incident 
sites  from  between  2001  to  2007.  The  isolated  incidents  on  Basilan  differed  slightly  from 
those  that  occurred  on  Sulu.  Both  municipalities  saw  more  total  incidents  throughout  the 
2001-2007  period,  fourteen  and  eight,  respectively.  The  2008  incident  in  Sumisip  was  an 
ambush;  looking  back  at  the  previous  seven  years,  the  municipality  saw  three  other 
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ambushes  in  2001,  2004,  and  2005;  only  encounters  outnumber  the  number  of  ambushes. 
The  2008  incident  in  Tipo-Tipo  was  a  harassment,  but  not  the  first  the  municipality  had 
seen;  six  harassments  occurred  the  year  before  throughout  the  municipality.  Compared  to 
the  incidents  that  took  place  on  Sulu,  the  type  of  incident  that  occurred  in  both  Sumisip 
and  Tipo-Tipo  was  more  likely  to  occur. 

ArcGIS  is  also  capable  of  conducting  Hot  Spot  Analysis.  However,  unlike 
CrimeStat,  which  calculates  a  hot  spot  simply  by  counting  how  many  incidents  occur  in 
the  same  location,  ArcGlS’s  Hot  Spot  Analysis  utilizes  the  Getis-Ord  Gi*  statistic: 

This  tool  works  by  looking  at  each  feature  within  the  context  of 
neighboring  features.  A  feature  with  a  high  value  is  interesting  but  may 
not  be  a  statistically  significant  hot  spot.  To  be  a  statistically  significant 
hot  spot,  a  feature  will  have  a  high  value  and  be  surrounded  by  other 
features  with  high  values  as  well.  The  local  sum  for  a  feature  and  its 
neighbors  is  compared  proportionally  to  the  sum  of  all  features;  when  the 
local  sum  is  very  different  from  the  expected  local  sum,  and  when  that 
difference  is  too  large  to  be  the  result  of  random  change,  a  statistically 
significant  z-score  results. 

The  resulting  z-scores  and  their  associated  p-values  tell  the  user  whether  or  not  a 
spot  has  a  high  or  low  cluster  spatially;  the  higher  the  z-score  (positive)  or  the  lower  the 
z-score  (negative),  the  more  intense  the  clustering  of  either  high  or  low  values. 

Both  the  incidents  that  occurred  on  Sulu  and  Basilan  during  the  years  2001  to 
2007  were  run  through  the  ArcGIS  Hot  Spot  Analysis  tool.  The  resulting  outputs  are 
displayed  in  Figures  5  and  6. 


47 


Esri,  “How  Hot  Spot  Analysis  (Getis-Ord  Gi*)  works,”  m  ArcGIS  10.2  Help  (1995-2013). 
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90%  Confidence  Cold  Spot 
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95%  Confidence  Hot  Spot 
99%  Confidence  Hot  Spot 


Figure  5.  ArcGIS  Hot  Spot  Analysis  of  2001-2007  Abu  Sayyaf  Group  Sulu  Incidents 
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Figure  6.  ArcGIS  Hot  Spot  Analysis  of  2001-2007  Abu  Sayyaf  Group  Basilan  Incidents 
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Just  as  with  the  CrimeStat  Hot  Spot  Analysis  Outputs,  the  results  of  the  ArcGIS 
Hot  Spot  Analysis  had  the  2008  incident  data  overlayed  to  determine  whether  or  not  any 
hot  or  cold  spot  based  on  the  data  from  2001  to  2007  was  the  site  of  an  incident  in  2008. 
The  resulting  images  are  depicted  in  Figures  7  and  8. 
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Figure  7.  2008  Incidents  Overlaid  on  ArcGIS  Hot  Spot  Analysis  of  2001-2007  Sulu  Incidents 
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Figure  8.  2008  Incidents  Overlaid  on  ArcGIS  Hot  Spot  Analysis  of  2001-2007 

Basilan  Incidents 


This  time  only  the  island  of  Sulu  has  its  one  identified  hot  spot  (90%  Confidence) 
serve  as  a  repeat  location  for  2008  incidents.  Like  the  hot  spot  identified  in  CrimeStat,  the 
ArcGIS-generated  hot  spot  is  located  in  the  municipality  of  Patikul  (121.039413, 
6.057583  Decimal  Degrees),  but  it  is  not  the  same  hot  spot,  though  this  hot  spot  also  is 
the  location  of  two  2008  incidents.  Unlike  Sulu,  Basilan’s  one  identified  hot  spot,  located 
in  Tuburan  (Coordinates:  122.239598,  6.630038  Decimal  Degrees),  is  not  the  location  of 
a  2008  incident.  The  only  overlap  occurs  at  a  location  in  Lamitan  (Coordinates: 
122.104057,  6.648478  Decimal  Degrees)  that  was  ruled  as  not  statistically  a  cold  or  hot 
spot  by  ArcGIS;  though  it  is  the  same  previously  identified  hot  spot  in  CrimeStat. 

Out  of  the  12  locations  that  experienced  an  incident  on  Sulu  in  2008,  seven  (58%) 
of  them  occur  in  locations  that  were  not  previously  the  site  of  an  attack  during  the  2001 
to  2007  period  (5/12  or  42%  occurred  at  a  previous  site).  Like  Sulu,  out  of  seven  sites 
that  experienced  an  incident  in  2008  on  Basilan,  only  one  of  the  sites  (14%)  was  a 
location  that  saw  an  incident  during  2001  to  2007.  Compared  to  having  absolutely  no 
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knowledge,  these  percentages,  although  low  (especially  Basilan’s),  give  rise  to  the 
examination  of  more  information  to  help  predict  terrorist  actions. 

Compared  to  ArcGIS,  the  CrimeStat  software’s  mode  routine  identified  more  hot 
spots  where  it  would  be  likely  to  see  future  activity.  For  CrimeStat  both  Sulu  and  Basilan 
saw  one  hot  spot  serve  as  the  location  of  a  2008  incident  resulting  in  a  low  percentage  of 
successful  prediction  for  the  two  cases  (8%  and  14%,  respectively).  ArcGIS’s  hot  spot 
analysis  identifies  only  one  statistically  significant  hot  spot  for  both  Sulu  and  Basilan, 
classifying  the  majority  of  sites  from  2001-2007  as  either  not  statistically  significant  or 
as  a  cold  spot  with  varying  degrees  of  confidence.  As  ArcGIS  only  identifies  one  hot  spot 
for  each  island,  and  only  the  hot  spot  in  the  municipality  of  Patikul  on  Sulu  has  an 
incident  occur  there  in  2008,  the  islands  have  the  resulting  percentages  from  whether  or 
not  an  identified  hot  spot  was  the  site  of  a  future  incident:  100%  for  Sulu  and  0%  for 
Basilan;  together  the  two  average  out  to  a  50%  ability  for  ArcGIS  hot  spot  analysis  to 
accurately  identify  possible  future  locations  for  incidents.  Again,  ignoring  the  identified 
hot  spots  and  simply  looking  at  what  percentage  of  locations  that  served  as  an  incident 
site  from  2001-2007  again  was  the  site  of  an  incident  in  2008  generates  the  following 
numbers:  42%  for  Sulu  (five  locations  out  of  twelve  2008  locations  saw  an  incident  in  the 
preceding  years)  and  14%  for  Basilan  (one  location  out  of  the  seven  2008  locations  saw 
an  incident  in  earlier  years).  A  summary  of  this  information  is  provided  in  Table  14. 
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CrimeStat 
Identified 
Hot  Spot 

Did  a  2008 
Incident 
Occur  at 
Same 
Location? 

Jolo  -  12 

Incidents 

No 

Indanan  - 
9  Incidents 

No 

Patikul  - 
9  Incidents 

Yes 

Talipao  - 
6  Incidents 

No 

Patikul  - 
6  Incidents 

No 

Indanan  - 
5  Incidents 

No 

Talipao  - 
4  Incidents 

No 

Parang  - 
4  Incidents 

No 

Jolo  -  4 

Incidents 

No 

Maimbung 

-4 

Incidents 

No 

Sumisip  - 
5  Incidents 

No 

Tuburan  - 
4  Incidents 

No 

Lamitan  - 
3  Incidents 

Yes 

Lamitan  - 
3  Incidents 

No 

Tipo-Tipo 

-3 

Incidents 

No 

Sumisip  - 
3  Incidents 

No 

Lantawan  - 
3  Incidents 

No 

Number 
of  Total 
2008 
Incidents 


Percentage 
of  2008 
Incidents 
Occurring 
at 

Identified 
Hot  Spot 


7  - 

Basilan 


ArcGIS 
Identified 
Hot  Spot 


Patikul  - 
90% 

Confidence 
Level 
Tuburan  - 
90% 

Confidence 

Level 


Did  a 
2008 
Incident 
Occur  at 
the  Same 
Location? 


Total 

Number  of 
Hot  Spots 
Identified 
in  ArcGIS 


I  -  Sulu 


Percentage 
of  Hot 
Spots 
Serving  as 
Location 
of  2008 
Incident 


I  -  Basilan  0.00 
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Although  the  resulting  percentages  for  successfully  identifying  locations  for  future 
incidents  are  low,  they  still  indicate  that  there  is  some  information  that  can  be  gathered 
from  this  type  of  analysis,  and  therefore,  hot  spot  analysis  should  not  be  easily  dismissed 
from  the  intelligence  process.  However,  these  software  packages  take  into  account 
neither  the  total  number  of  incidents  nor  the  population  of  the  area  being  analyzed  when 
identifying  hot  spots,  something  that  would  help  put  all  the  studied  municipalities  on  an 
equal  level;  this  can  be  accomplished  by  normalizing  the  incident  data. 

D.  INCIDENT  NORMALIZATION 

Another  method  for  interpreting  the  data  for  both  Sulu  and  Basilan  was  in  taking 
the  total  number  of  incidents  that  occurred  in  each  municipality  and  normalizing  that 
number  by  either  the  total  number  of  incidents  that  occurred  on  the  entire  island  or  by  the 
population  of  the  municipality.  The  total  number  of  incidents  in  each  municipality  and  for 
the  entire  island  as  well  as  the  resultant  normalization  value  and  category  for  both  2001 
to  2007  and  2008  for  the  island  of  Sulu  are  shown  in  Table  15  and  depicted  in  Figures  9 
and  10.  The  different  categorization  levels  for  the  normalization  values  are  drawn  out  in 
Table  16  in  order  to  illustrate  the  range  each  municipality  falls  under. 
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Municipality 

Total  Number 
of  Incidents  in 
Municipality: 
2001  -  2007 

Total  Number 
of  Incidents 
in  Sulu: 

2001  -  2007 

Normalization 

Value 

2001  -  2007 

Normalization 

Category 

Total  Number 
of  Incidents  in 
Municipality: 
2008 

Total  Number  of 
Incidents  in 
Sulu:  2008 

Normalization 
Value  2008 

Normalization 

Category 

Indanan 

30 

158 

0.1899 

1 

22 

0.04545 

2 

Jolo 

23 

0.1456 

4 

0 

0.000 

1 

Kalingalan 

Caluang 

4 

0.02532 

2 

0 

0.000 

1 

Luuk 

0 

0.000 

1 

1 

0.04545 

2 

Maimbung 

20 

0.1266 

4 

4 

0.1818 

3 

Old 

Panamao 

7 

0.0443 

3 

0 

0.000 

1 

Panglima 

Estino 

2 

0.0127 

2 

1 

0.04545 

2 

Parang 

10 

0.06329 

3 

1 

0.04545 

2 

Patikul 

32 

0.2025 

13 

Talipao 

30 

0.1899 

1 

0.04545 

2 

Table  15.  Normalization  of  Municipality  Incidents  by  Total  Sulu  Incidents 
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Normalization 

Category 

Normalization 
Value  Range; 
2001  -  2007 

Category 

Color 

Normalization 

Category 

Normalization 
Value  Range;  2008 

Category 

Color 

1 

0.000 

Blue 

1 

0.000 

Blue 

2 

0.00010-0.02532 

Green 

2 

0.00010-0.04545 

Green 

3 

0.02533  -  0.06329 

Yellow 

3 

0.04546-0.1818 

Yellow 

4 

0.06330-0.1456 

Orange 

4 

0.1819-0.5909 

5 

1457  0.2025 

Table  16.  Normalization  Category  Levels 


In  this  thesis,  the  normalization  category  that  is  red  in  color  (Category  4  or  5 
depending)  highlights  a  strong  or  high  value  and  the  blue  normalization  category 
(Category  1)  is  indicative  of  a  weak  or  low  result. 


Figure  9.  Normalization  of  Municipality  Incidents  by  Total  Sulu  Incidents: 

2001-2007 
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Figure  10.  Normalization  of  Municipality  Incidents  by  Total  Sulu  Incidents: 

2008 


Comparing  the  normalization  values  of  each  municipality’s  incidents  by  the 
island’s  total  number  of  incidents  from  2001  to  2007  to  the  values  for  2008,  there  are  two 
consistencies  observed:  Patikul  and  Panglima  Estino.  In  both  instances  Patikul  falls  in  the 
highest  normalization  value,  which  corresponds  to  this  region  experiencing  the  highest 
number  of  incidents  in  both  time  periods;  Panglima  Estino ’s  normalization  values  keep 
the  municipality  solidly  in  category  2  in  both  year  groupings.  In  both  cases,  these  can  be 
considered  as  important  pieces  of  information  for  security  forces;  from  this  analysis  they 
would  identify  Patikul  as  an  area  to  watch  closely  as  it  sees  the  most  activity  and 
Panglima  Estino  sees  consistently  less  activity,  where  perhaps  they  would  not  focus  as 
much  attention.  There  is  only  one  municipality  that’s  normalization  value  increases  from 
the  2001  to  2007  time  to  2008:  Euuk;  this  municipality  only  experiences  one  incident 
during  all  eight  years,  which  occurred  in  2008,  the  second  time  frame.  The  other  eight 
municipalities  all  decrease  in  normalization  category,  most  by  a  level  of  one,  though  Jolo 
does  drop  from  level  (4)  to  level  (1)  when  it  experiences  zero  attacks  in  the  2008  year. 

The  total  number  of  incidents  in  each  municipality,  and  for  the  entire  island  as 
well  as  the  resultant  normalization  value  and  category  for  both  2001  to  2007  and  2008  for 
the  island  of  Basilan,  are  shown  in  Table  17  and  depicted  in  Eigures  11  and  12.  As  the 
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normalization  values  for  each  category  have  changed  for  the  island  of  Basilan,  new 
ranges  are  displayed  in  Table  18. 
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Municipality 

Total  Number 
of  Incidents  in 
Municipality: 
2001  -  2007 

Total  Number 
of  Incidents  in 
Basilan: 

2001  -  2007 

Normalization 

Value 

2001  -  2007 

Normalization 

Category 

Total  Number 
of  Incidents  in 
Municipality: 
2008 

Total  Number 
of  Incidents  in 
Basilan: 

2008 

Normalization 
Value  2008 

Normalization 

Category 

Isabela 

10 

63 

0.1587 

4 

0 

15 

0.00000 

1 

Lamitan 

12 

0.1905 

4 

1 

0.06667 

2 

Lantawan 

10 

0.1587 

4 

0 

0.00000 

1 

Maluso 

2 

0.03175 

2 

0 

0.00000 

1 

Sumisip 

15 

0.2381 

1 

0.06667 

2 

Tipo-Tipo 

8 

0.1270 

3 

4 

0.26667 

3 

Tuburan 

6 

0.0952 

3 

9 

Table  17.  Normalization  of  Municipality  Incidents  by  Total  Basilan  Incidents 


Normalization 

Category 

Normalization 
Value  Range: 
2001  -  2007 

Category 

Color 

Normalization 

Category 

Normalization 
Value  Range;  2008 

Category 

Color 

1 

0.000 

Blue 

1 

0.000 

Blue 

2 

0.00010-0.03175 

Green 

2 

0.00010-0.06667 

Green 

3 

0.03176-0.1270 

Yellow 

3 

0.06668  -  0.2667 

Yellow 

4 

0.1271  -0.1905 

Orange 

4 

0.2668  -  0.6000 

5 

0.1906-0.2381 

Table  18.  Normalization  Category  Levels 
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Due  to  the  small  number  of  values  utilized  in  determining  the  normalization 
values  in  2008,  there  are  only  four  normalization  categories  compared  to  the  five 
categories  from  the  2001  to  2007  range. 


Figure  11.  Normalization  of  Municipality  Incidents  by  Total  Basilan  Incidents: 

2001-2007 
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Figure  12.  Normalization  of  Municipality  Incidents  by  Total  Basilan  Incidents: 

2008 

For  Basilan,  like  Sulu,  the  island  highlights  a  consistency  from  the  2001  to  2007 
value  to  the  2008  value:  Tipo-Tipo,  the  municipality  remains  in  the  yellow  category  in 
both  phases,  the  third  from  the  bottom.  Beyond  this  municipality,  the  others  switch 
normalization  categories  seemingly  at  random. 

Beyond  comparing  the  values  from  the  2001-2007  time  period  to  those  that 
occurred  in  2008,  each  year  can  be  compared  to  the  others  and  the  average  of  those  years. 
The  average  of  the  years  2001-2007  is  compared  to  2008  in  order  to  determine  whether 
any  pattern  from  year-to-year  emerges.  The  yearly  normalization  numbers  for  each  year 
and  the  averages  are  displayed  in  Table  19. 
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Sulu 

Number  of  Incidents  Occurred  in  Municipality  /  Normalization  by  Year’s  Total  Incidents 

Year 

2001 

2002 

2003 

2004 

2005 

2006 

2007 

Average 

2008 

Percent  Error 

Total 

Incidents 

Occurred 

44 

10 

19 

10 

27 

31 

17 

22.57143 

22 

2.597402597 

Municipality 

Indanan 

3 

4 

2 

0 

11 

6 

4 

4.285714 

1 

328.57 

0.06818 

0.4 

0.10526 

0 

0.40741 

0.19355 

0.23529 

0.201385 

0.04545 

343.05 

Jolo 

5 

0 

3 

1 

0 

14 

0 

3.285714 

0 

0.11364 

0 

0.15789 

0.1 

0 

0.45161 

0 

0.117592 

0 

Kalingalan 

Caluang 

2 

1 

0 

0 

0 

0 

1 

0.571429 

0 

0.04545 

0.1 

0 

0 

0 

0 

0.05882 

0.029183 

0 

Luuk 

0 

0 

0 

0 

0 

0 

0 

0 

1 

100.00 

0 

0 

0 

0 

0 

0 

0 

0 

0.04545 

100.00 

Maimbung 

5 

0 

2 

D 

4 

4 

1 

2.857143 

4 

28.57 

0.11364 

0 

0.10526 

0.14815 

0.12903 

0.05882 

0.136415 

0.18182 

24.97 

Old  Panamao 

2 

0 

2 

0 

3 

0 

0 

1 

0 

0.04545 

0 

0.10526 

0 

0.11111 

0 

0 

0.037404 

0 

Panglima 

Estino 

1 

0 

0 

0 

0 

0 

1 

0.285714 

1 

71.43 

0.02273 

0 

0 

0 

0 

0 

0.05882 

0.01165 

0.04545 

74.37 

Parang 

0 

1 

0 

1 

4 

0 

4 

1.428571 

1 

42.86 

0 

0.1 

0 

0.1 

0.14815 

0 

0.23529 

0.083349 

0.04545 

83.37 

Patikul 

7 

4 

7 

D 

3 

5 

2 

4.571429 

13 

64.84 

0.15909 

0.4 

0.36842 

0.11111 

0.16129 

0.11765 

0.245366 

0.59091 

58.48 

Talipao 

19 

0 

3 

0 

2 

2 

4 

4.285714 

1 

328.57 

0.43182 

0 

0.15789 

0 

0.07407 

0.06452 

0.23529 

0.137657 

0.04545 

202.84 

Table  19.  Sulu  Island-Wide  and  Municipality-Level  Normalization  Values  by 

Year 


For  Sulu,  the  average  number  of  incidents  per  year  based  on  the  2001-2007 
numbers  was  just  over  22.5;  comparing  this  to  the  total  number  of  incidents  in  2008,  22, 
yields  a  percent  difference  between  the  two  of  fewer  than  3%,  meaning  that  the  number 
of  incidents  in  2008  follows  the  number  of  incidents  one  would  expect  to  occur. 
However,  other  than  providing  information  toward  the  grand  picture,  this  result  would 
not  tell  security  forces  where  to  possibly  expect  future  attacks  just  that  in  general  they 
should  expect  about  twenty-two  attacks  to  occur  in  a  given  year.  While  the  total  number 
of  incidents  for  the  entire  island  is  consistent  with  the  yearly  average,  the  same  is  not  true 
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for  each  municipality.  The  municipality  with  the  lowest  percent  difference  for  both  the 
total  number  of  incidents  and  the  normalization  of  those  incidents  by  the  island’s  total 
incidents  is  Maimbung,  but  even  those  values  are  high,  28.57%  and  24.97%,  respectively; 
the  other  municipalities’  values  range  from  58.48%  to  as  high  as  343.05%.  These 
resulting  percentages  demonstrates  that  like  the  2001-2007  total  values  compared  to  the 
2008  values,  using  the  averages  from  the  same  time  period  and  comparing  to  the  2008 
values  produces  very  little  information  to  go  on,  though  the  total  number  of  anticipated 
incidents  may  be  able  to  be  predicted. 


Basilan 

Number  of  Incidents  Occurred  in  Municipality  /  Normalization  by  Year's  Total  Incidents 

Year 

2001 

2002 

2003 

2004 

2005 

2006 

2007 

Average 

2008 

Percent 

Error 

Total 

Incidents 

Occurred 

27 

9 

8 

6 

D 

0 

9 

9 

15 

40 

Municipality 

Isabela 

2 

3 

2 

2 

0 

0 

1 

1.428571 

0 

0.07407 

0.333333 

0.25 

0.33333 

0 

0 

0.11111 

0.157407 

0 

Lamitan 

10 

0 

0 

1 

0 

0 

1 

1.714286 

1 

71.43 

0.37037 

0 

0 

0.16667 

0 

0 

0.11111 

0.092593 

0.06667 

38.89 

Lantawan 

4 

2 

3 

0 

0 

0 

1 

1.428571 

0 

0.14815 

0.222222 

0.375 

0 

0 

0 

0.11111 

0.122354 

0 

Maluso 

1 

0 

0 

1 

0 

0 

0 

0.285714 

0 

0.03704 

0 

0 

0.16667 

0 

0 

0 

0.029101 

0 

Sumisip 

5 

4 

1 

2 

3 

0 

0 

2.142857 

1 

114.29 

0.18519 

0.444444 

0.125 

0.33333 

0.75 

0 

0 

0.262566 

0.06667 

293.85 

Tipo-Tipo 

2 

0 

0 

0 

0 

0 

6 

1.142857 

4 

71.43 

0.07407 

0 

0 

0 

0 

0 

0.66667 

0.10582 

0.26667 

60.32 

Tuburan 

3 

0 

2 

0 

1 

0 

0 

0.857143 

9 

90.48 

0.11111 

0 

0.25 

0 

0.25 

0 

0 

0.087302 

0.6 

85.45 

Table  20.  Basilan  Island-Wide  and  Municipality  Level  Normalization  Values 

by  Year 


Like  the  average  values  for  Sulu,  the  average  values  for  Basilan  based  on  total 
incident  number  and  the  normalization  values,  does  not  yield  results  that  appear  to  be 
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helpful  in  the  prediction  of  incident  numbers  in  2008,  for  either  the  island  as  a  whole  or 
for  each  municipality. 


The  other  method  of  normalizing  the  incident  number  is  by  the  population  of  each 
municipality.  The  total  number  of  incidents  occurring  in  the  municipality,  the  population 
of  the  municipality,  and  the  resultant  value  are  displayed  in  Tables  21  and  22. 


Municipality 

Total  Number 
of  Incidents  in 
Municipality; 
2001-2007 

Population  of 
Municipality  (2000) 

Incident 
Number 
Normalized  by 
Population 

Indanan 

30 

53425 

0.0005615 

Jolo 

23 

87998 

0.0002614 

Kalingalan 

Caluang 

4 

22688 

0.0001763 

Luuk 

0 

38819 

0.0000000 

Maimbung 

20 

24982 

0.0008006 

Old  Panamao 

7 

35906 

0.0001950 

Panglima 

Estino 

2 

21443 

0.0000933 

Parang 

10 

54994 

0.0001818 

Patikul 

32 

34396 

0.0009303 

Talipao 

30 

73015 

0.0004109 

Table  21.  Normalization  Values  of  Sulu  Municipalities  Based  on  2001  to  2007 

Incidents 


Municipality 

Total  Number 
of  Incidents  in 
Municipality: 
2001-2007 

Population  of 
Municipality  (2000) 

Incident 
Number 
Normalized  by 
Population 

Isabela 

10 

73032 

0.0001369 

Lamitan 

12 

58709 

0.0002044 

Lantawan 

10 

27487 

0.0003638 

Maluso 

2 

31054 

0.0000644 

Sumisip 

15 

51712 

0.0002901 

Tipo-Tipo 

8 

48284 

0.0001657 

Tuburan 

6 

42550 

0.0001410 

Table  22.  Normalization  Values  of  Basilan  Municipalities  Based  on  2001  to 

2007  Incidents 
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The  same  level  of  interpretation  was  done  for  the  municipalities  and  the  events 
that  occurred  in  them  during  2008;  the  results  are  shown  in  Tables  23  and  24. 


Municipality 

Total  Number 
of  Incidents  in 
Municipality: 
2008 

Population  of 
Municipality  (2000) 

Incident 
Number 
Normalized  by 
Population 

Indanan 

1 

53425 

0.0000187 

Jolo 

0 

87998 

0.0000000 

Kalingalan 

Caluang 

0 

22688 

0.0000000 

Luuk 

1 

38819 

0.0000258 

Maimbung 

4 

24982 

0.0001601 

Old  Panamao 

0 

35906 

0.0000000 

Panglima 

Estino 

1 

21443 

0.0000466 

Parang 

1 

54994 

0.0000182 

Patikul 

13 

34396 

0.0003780 

Talipao 

1 

73015 

0.0000137 

Table  23.  Normalization  Values  of  Sulu  Municipalities  Based  on  2008 

Incidents 


Municipality 

Total  Number 
of  Incidents  in 
Municipality: 
2008 

Population  of 
Municipality  (2000) 

Incident 
Number 
Normalized  by 
Population 

Isabela 

0 

73032 

0.0000000 

Lamitan 

1 

58709 

0.0000170 

Lantawan 

0 

27487 

0.0000000 

Maluso 

0 

31054 

0.0000000 

Sumisip 

1 

51712 

0.0000193 

Tipo-Tipo 

4 

48284 

0.0000828 

Tuburan 

9 

42550 

0.0002115 

Table  24.  Normalization  Values  of  Basilan  Municipalities  Based  on  2008 

Incidents 


In  order  to  compare  the  normalization  values  from  2001-2007  to  the  values  from 
2008,  the  normalization  values  were  divided  into  five  categories.  The  categories  were 
defined  as  follows  in  Table  25. 
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Normalization 

Category 

Normalization  Value 
Range 

Category  Color 

1 

0.00  -  0.0000999 

Blue 

2 

0.0001000  - 
0.0002614 

Green 

3 

0.0002615  - 
0.0004109 

Yellow 

4 

0.0004110- 

0.0005615 

Orange 

5 

Table  25.  Normalization  Categories 


The  resulting  comparison  of  normalization  values  from  2001-2007  and  2008  for 
both  Sulu  and  Basilan  are  shown  in  Tables  26  and  27  and  depicted  in  Figures  13,  14,  15, 
and  16. 


Municipality 

Normalization  Value 
2001  -  2007 

Normalization 

Category 

Normalization 
Value  2008 

Normalization 

Category 

Indanan 

0.000561535 

4 

0.0000187 

2 

Jolo 

0.00026137 

2 

0.0000000 

1 

Kalingalan 

Caluang 

0.000176305 

2 

0.0000000 

1 

Luuk 

0.0000000 

1 

0.0000258 

2 

Maimbung 

0.000800576 

0.0001601 

4 

Old  Panamao 

0.000194953 

2 

0.0000000 

1 

Panglima 

Estino 

0.0000933 

2 

0.0000466 

3 

Parang 

0.000181838 

2 

0.0000182 

2 

Patikul 

0.000930341 

Talipao 

0.000410874 

3 

0.0000137 

2 

Table  26.  Comparison  of  Sulu  Normalization  Categories 
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Figure  13.  Sulu  2001-2007  Incidents  Normalized  by  Municipality  Population 


Figure  14.  Sulu  2008  Incidents  Normalized  by  Municipality  Population 


Municipality 

Normalization  Value 
2001  -  2007 

Normalization 

Category 

Normalization 
Value  2008 

Normalization 

Category 

Isabela 

0.0001369 

3 

0.0000000 

1 

Lamitan 

0.0002044 

4 

0.0000170 

2 

Lantawan 

0.0003638 

0.0000000 

1 

Maluso 

0.0000644 

2 

0.0000000 

1 

Sumisip 

0.0002901 

0.0000193 

3 

Tipo-Tipo 

0.0001657 

3 

0.0000828 

4 

Tuburan 

0.0001410 

3 

0.0002115 

Table  27.  Comparison  of  Basilan  Normalization  Categories 
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Figure  15.  Basilan  2001-2007  Incidents  Normalized  by  Municipality 

Population 


Figure  16.  Basilan  2008  Incidents  Normalized  by  Municipality  Population 
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When  the  figures  for  each  island  for  the  2001  to  2007  incidents  are  compared  to 
the  same  island’s  figure  for  2008,  some  consistancy  is  observed.  For  instance,  for  Sulu, 
Patikul  once  again  remains  in  the  highest  normalization  category  (5)  and  Parang  remains 
in  the  second  lowest  normalization  category  (2).  Again,  this  is  bit  of  information  could 
prove  useful  to  security  forces  in  planning  operations  and  patrols,  for  they  could  see 
where  activity  is  consistently  high  and  where  it  is  lower.  However,  out  of  the  eight 
remaining  municipalities,  only  one  changes  its  normalization  category  by  more  than  one 
(Indanan  -  4  to  2).  As  for  Basilan,  none  of  the  seven  municipalities  maintain  their 
original  normalization  category,  and  five  out  of  the  seven  change  normalization 
categories  by  two  or  more  levels. 

If  the  normalization  values  by  population  for  each  year  and  each  municipality  on 
both  islands  are  averaged  and  compared  to  the  actual  values  for  2008,  like  the  percent 
errors  obtained  from  the  normalization  of  incidents  by  total  incidents,  these  percent  errors 
are  large  in  number,  ranging  from  28.57%-328.57%. 

Overall,  the  results  of  utilizing  geographic  profiling  techniques  on  the  incident 
data  for  Sulu  and  Basilan  indicate  potential  for  being  useful  in  the  determination  of  where 
future  incidents  could  occur;  however,  further  analysis  on  different  pieces  of  data  is 
required  in  order  to  determine  whether  these  techniques  could  aid  in  future  prediction 
efforts.  Perhaps,  with  different  data  sets,  there  lies  the  possibility  of  utilizing  more 
complex  geographic  profiling  techniques  that  were  not  feasible  with  this  thesis’  data, 
which  could  provide  more  predictive  information  and  therefore,  more  clear-cut  results. 
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V.  DISCUSSION  AND  CONCLUSION 


A.  DISCUSSION 

Utilizing  statistical  analysis,  CrimeStat,  and  ArcGIS,  the  results  of  utilizing 
geographic  profiling  techniques  yielded  an  assortment  of  results,  some  useful,  and  other 
results  not. 

From  the  statistical  analysis  conducted,  the  results  for  the  two  islands  of  Sulu  and 
Basilan  tended  to  contradict  each  other,  meaning  that  there  was  not  much  consistency 
between  the  islands,  at  least  when  it  came  to  predicting  whether  an  incident  would  occur 
within  a  particular  area  in  the  future.  While  municipalities  on  the  island  of  Sulu  were 
more  likely  to  experience  a  2008  incident  if  they  experienced  an  incident  in  more  of  the 
seven  years  preceding  2008,  the  opposite  held  true  in  Basilan  where  a  municipality  was 
more  likely  to  be  the  location  of  a  2008  incident  if  they  experienced  incidents  in  three  or 
fewer  preceding  years.  In  looking  at  the  likelihood  of  a  particular  type  of  incident 
occurring  in  Sulu  and  Basilan,  the  two  islands  tend  to  share  more  in  common  with  one 
another  because  if  the  island  experienced  a  particular  type  of  incident  in  three  or  more  out 
of  the  seven  preceding  years,  approximately  two-thirds  of  the  time,  they  would 
experience  that  type  of  incident  again  in  2008.  For  those  incidents  that  occurred  in  more 
than  three  years  leading  up  to  2008,  but  did  not  actually  occur  in  2008,  these  types  of 
incidents  all  occurred  in  2004  or  before,  never  after.  However,  when  looking  at  the  2008 
incidents  themselves,  Sulu’s  incidents  tended  to  follow  the  pattern  that  if  a  particular  type 
of  incident  occurred  in  multiple  years,  it  was  more  likely  to  occur  again  in  2008;  but  in 
Basilan  only  a  third  of  the  2008  incident  types  occurred  in  three  or  more  years.  Again, 
inconsistencies  between  the  two  islands  make  it  difficult  to  develop  an  actual  prediction. 

From  CrimeStat,  the  Hot  Spot  Analysis  reveals  the  locations  that  experienced  the 
most  incidents  over  a  seven  year  period.  However,  in  terms  of  prediction  value,  for  both 
Sulu  and  Basilan,  this  analysis  did  not  contribute  much.  The  generated  hot  spots  tended  to 
not  serve  as  the  location  of  an  incident  in  2008;  only  fifteen  percent  (or  less)  of  the  hot 
spots  saw  an  incident  occur  again  in  2008.  While  CrimeStat’s  Hot  Spot  Analysis  provides 
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a  slight  indication  of  where  a  future  incident  would  likely  occur,  the  Hot  Spot  Analysis 
conducted  by  ArcGIS  does  not  fare  much  better.  On  both  islands,  the  model  only 
generates  one  hot  spot  location,  more  often  than  not;  the  locations  of  incidents  from  2001 
to  2007  were  categorized  as  being  not  significant  of  a  spot,  though  in  a  few  instances  the 
sites  were  identified  as  cold  spots.  Of  the  sites  identified  as  hot  spots,  only  on  Sulu  does  a 
2008  incident  occur  at  the  same  location  as  a  previously  identified  hot  spot.  Even  when 
looking  at  the  incidents  as  a  whole,  the  percentage  of  2008  incidents  that  occur  in 
previously  attacked  locations,  only  reaches  forty-two  percent  for  Sulu  and  fourteen 
percent  for  Basilan,  percentages  that  are  not  high  enough  to  help  serve  a  predictive 
function. 

The  predictive  ability  of  incident  normalization,  when  looking  at  the  incidents  in 
terms  of  their  total  numbers  from  2001-2007  for  each  municipality  and  normalizing  by 
total  incident  number  for  the  entire  island,  provided  little  information.  Most  of  the 
municipalities  on  both  islands  see  a  reduction  in  their  normalization  category,  though 
three  municipalities  maintain  their  level  and  one,  Tuburan,  actually  increases.  The  same 
basically  holds  true  when  the  incidents  that  occurred  from  2001-2007  are  normalized  by 
the  2000  population  of  the  municipality.  When  the  2001-2007  incidents  are  averaged 
instead  of  simply  being  combined,  a  bit  more  information  can  be  extracted.  For  both 
islands,  the  expected  number  of  incidents  in  total  for  each  island  is  roughly  similar, 
though  it  is  much  better  for  Sulu  than  Basilan,  meaning  that  authorities  could  at  least 
begin  to  predict  how  many  incidents  in  total  the  island  should  expect  in  a  given  year. 
Unfortunately,  on  the  municipality  level,  the  numbers  vary  on  a  large  scale  from  the 
anticipated  values,  once  again  decreasing  the  predictive  capability  of  the  method. 

Overall,  these  results  do  not  speak  highly  of  the  predictive  nature  of  geographic 
profiling  techniques;  however,  while  the  resulting  percentages  were  not  very  high,  the 
fact  that  most  of  these  methods  of  analysis  produce  even  a  result  at  all  means  that  they 
have  future  application.  The  process  intelligence  analysts  and  law  enforcement  officials 
go  through  currently  to  predict  likely  locations  of  where  terrorists  and  criminals  attack 
and  operate  involves  multiple  methods,  which  all  together  aid  in  the  determination  of  the 
most  likely  areas;  these  geographic  profiling  techniques  provide  yet  another  level  of 
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analysis  to  help  in  this  determination.  Perhaps  when  added  into  several  existing  methods, 
information  can  be  revealed  that  would  have  previously  gone  undetected. 

The  results  of  this  thesis  may  simply  highlight  that  for  all  the  similarities  shared 
between  serial  criminals  and  terrorists,  the  two  entities  are  just  too  different  from  one 
another  for  a  technique  that  works  on  one  to  work  for  the  other.  Terrorists  tend  to  be 
motivated  by  an  ideology  and  choose  their  targets  in  order  to  generate  fear  among  the 
population  and  force  the  government  to  take  action  against  a  perceived  injustice  held  by 
the  terrorists,  while  serial  criminals  and  serial  killers  or  rapists  in  particular  tend  to  target 
people  who  fit  a  certain  description  in  order  to  act  out  anger  on  someone  who  has 
wronged  them  previously,  without  a  further  goal  of  soliciting  a  government  response.  Of 
course,  the  largest  difference,  which  makes  determining  the  location  of  a  terrorist  base  of 
operations  difficult,  is  that  serial  criminals  tend  to  be  an  individual,  but  with  a  terrorist 
organization,  it  is  challenging  to  pick  out  one  individual  so  instead,  the  focus  turns 
toward  applying  efforts  meant  for  one  person  to  an  entire  group.  However,  this  thesis 
focused  on  the  prediction  of  where  a  terrorist  organization  will  strike  next  and  not  where 
they  operate  from;  even  though  this  is  the  case,  due  to  the  underlying  differences  between 
an  individual  committing  crimes  and  an  entire  group  conducting  attacks,  it  may  be 
enough  to  make  the  application  not  feasible.  Once  again,  further  analysis  is  required  in 
order  to  determine  whether  this  feasibility  exists;  from  this  thesis,  the  process  appears 
promising. 

B.  LIMITATIONS 

There  are  several  limitations  to  this  study,  particularly  in  terms  of  data  and  its 
ability  to  be  incorporated  into  the  analysis  packages.  The  data  utilized  in  this  thesis  came 
from  one  source,  meaning  that  potentially  not  all  incidents  were  included  in  the  data  set. 
The  data  itself  had  so  much  information,  in  terms  of  numbers,  that  it  had  to  be  reduced 
down  to  one  particular  group,  mostly  in  order  to  keep  the  incidents  that  occurred  in  the 
same  general  area  so  that  the  analysis  was  not  conducted  throughout  the  entire  southern 
Philippines.  The  incident  data,  even  prior  to  reduction,  only  included  so  much 
information  about  a  particular  attack,  leading  to  confusion  about  what  each  type  of 
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incident  had  occurred.  Beyond  the  possible  confusion  introduced  by  the  data  itself,  there 
were  aspects  of  the  data  that  did  not  mesh  well  with  the  programs  utilized.  The  CrimeStat 
software  was  not  able  to  be  utilized  to  its  fullest  potential  because  of  the  data  inputted 
into  it;  only  one  method  of  analysis  was  able  to  be  run.  Even  in  ArcGIS  the  data  ran  into 
problems  when  the  software  processes  required  more  information  than  available.  These 
issues  may  not  have  arisen  if  different  geographic  profiling  software,  such  as  Dragnet  and 
Rigel  Analyst,  but  as  CrimeStat  was  the  only  program  easily  obtained;  the  other  software 
packages  were  not  used.  Lastly,  this  thesis  only  focused  on  the  one  data  set;  there  is  more 
room  for  further  analysis  of  data  to  be  run  through  these  programs. 

C.  CONCLUSIONS 

The  utilization  of  geographic  profiling  in  the  hunt  for  serial  criminals  has  found 
success  for  law  enforcement  agencies.  Although  it  seems  difficult,  there  is  room  available 
for  incorporation  into  the  analysis  process  utilized  by  intelligence  personnel  to  predict 
where  future  terrorist  activity  could  occur.  Even  though  this  thesis  analyzed  a  limited 
amount  of  data,  it  still  provided  key  pieces  of  information  from  which  observations  could 
be  made  by  security  forces  in  the  Philippines  that  have  the  potential  to  help  aid  in 
planning  either  operations  or  security  patrols  in  regions  where  the  Abu  Sayyaf  Group 
operates. 

Geographic  profiling  is  a  newer  method,  meaning  that  as  time  passes, 
improvements  will  be  made  to  existing  techniques  that  will  only  help  the  field  grow. 
While  this  thesis  has  not  been  able  to  show  that  geographic  profiling  techniques  are  the 
next  “silver  bullet”  in  the  prediction  of  terrorist  attacks,  it  has  illustrated  the  possibilities 
the  method  offers  in  helping  to  further  analysis.  This  thesis  only  provided  one  attempt  of 
applying  existing  geographic  profiling  methods  to  terrorist  incident  data,  future  efforts  to 
explore  the  possibility  of  geographic  profiling  terror  attacks  and  terrorists  need  to  be  run 
on  several  different  types  of  data  and  on  several  different  scales  of  data. 

These  future  efforts  could  include  many  possibilities;  it  will  take  time  to 
determine  what  sort  of  data  and  how  much  data  is  required  in  order  to  be  most  compatible 
with  the  geographic  profiling  software  utilized.  Eirst,  perhaps  there  is  an  aspect  of 
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CrimeStat  that  was  not  compatible  with  the  data  used;  running  the  same  data  through 
different  software  packages  could  yield  other  results,  ones  that  may  be  able  to  provide  a 
more  in-depth  picture.  Even  just  from  the  complete  data  set  utilized  in  this  thesis  there 
were  several  different  groups  whose  actions  could  be  analyzed;  perhaps  groups  such  as 
the  Moro  Islamic  Liberation  Front  and  their  greater  number  of  incidents  as  well  as  their 
more  spread  out  nature  provide  a  better  set  of  data  to  study.  On  the  other  hand,  many 
current  applications  of  geographic  profiling  by  law  enforcement  agencies  are  restricted  to 
city-level  analysis  and  in  running  analysis  over  an  entire  island,  the  area  was  simply  too 
large  to  be  accurately  interpreted;  therefore,  finding  a  portion  of  the  data  which  is  great  in 
number  and  concentrated  around  a  city  or  established  place  would  enable  the  software  to 
provide  a  better  analysis  of  incident  data.  The  incident  data  from  this  thesis  also  spanned 
a  large  period  of  time,  eight  years;  again,  this  could  have  been  too  much  for  the  programs 
utilized  and  because  the  hot  spot  analysis  was  run  on  a  seven  year  period,  important 
aspects  about  the  data  and  the  progression  of  incidents  was  missed.  Beyond  the  data  set 
studied  in  this  thesis,  there  is  a  wealth  of  other  incident  data  sets  that  could  be  analyzed  in 
order  to  determine  if  a  particular  type  of  information  is  more  suited  for  application  of 
geographic  profiling  techniques.  This  thesis  serves  merely  as  a  beginning  for  future  and 
more  in-depth  efforts  into  determining  whether  geographic  profiling  is  applicable  to  the 
intelligence  process  in  the  search  for  terrorists;  however,  this  thesis  has  been  able  to 
demonstrate  that,  while  small,  at  present,  such  a  possibility  does  exist  and  needs  to  be 
further  explored. 
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